The answer depends entirely on which part of the QR code system you are asking about. The image pattern itself cannot be hacked. The infrastructure around some QR codes can be. Understanding the three distinct attack surfaces tells you exactly what to protect against - and which code type eliminates two of them entirely.
The Technical Answer: The Pattern Cannot Be Hacked - But Three Things Around It Can
A QR code image is a static visual representation of data - no different from a printed barcode or a page of text. Pointing your camera at the pattern cannot execute code, install malware, or access your contacts. The image is inert.
However, three components of the broader QR code system can be exploited:
- The physical surface it is printed on - attackers can overlay a fake code on top of a real one
- The redirect server (dynamic codes only) - if the QR service's server is compromised, every hosted code can be silently redirected to a phishing destination
- The generator - some online generators harvest the data you type in before encoding it
Attack Type 1: Physical Code Substitution (Sticker Overlay)
This is the most common real-world attack. A criminal prints a QR code linking to a phishing site and places it over a legitimate code on a public surface. Confirmed target locations include: parking meters, restaurant tables, bike-share station payment panels, ATM contactless pay prompts, and hotel room service cards.
Your phone cannot tell the difference between a legitimate printed code and a sticker placed over one - both are just patterns of black and white squares. You scan, your phone resolves the URL, you tap the preview bubble, and you land on a fake payment page.
The tell: Run your fingernail around the edge of any public QR code before scanning. A sticker overlay creates a slight raised border where the adhesive meets the underlying surface. If anything feels raised or layered, do not scan.
The Federal Trade Commission issued a consumer alert in December 2023 specifically warning about sticker overlay attacks, confirming scammers are "tampering with QR codes" in public spaces to redirect payments.
Attack Type 2: Dynamic QR Code Server Compromise
This attack applies exclusively to dynamic QR codes and has no equivalent for static codes. A dynamic QR code stores a redirect URL that points to a third-party server. That server resolves the redirect to your actual destination on every scan.
If the QR service provider's server infrastructure is breached, an attacker gains the ability to change where every hosted code redirects - without touching a single physical code. Codes on ATM vestibule walls, product packaging, or 10,000 restaurant table tents can be silently redirected to a phishing site in under a minute if the central server is compromised.
A static QR code has no server to compromise. The destination is encoded into the image at creation. There is no redirect, no server, and no man-in-the-middle. The code either points to its original destination or it does not scan at all.
Attack Type 3: Generator Data Harvesting
When you type your WiFi password, private URL, or contact information into an online QR code generator, that data travels to the generator's server to be encoded - unless the generator performs encoding in-browser. Generators that process data server-side log what you type. Risks include:
- WiFi password exposure: Network credentials stored in the provider's database are at risk in any breach of that database.
- Private URL exposure: Internal document links, draft pages, private Google Drive URLs stored on a third party's server.
- vCard data: Phone number, email address, employer, and home address entered into a vCard generator may be retained for marketing or sold.
To check: open your browser's developer tools and watch the Network tab while you type your data. Any outbound request containing your password as you encode is a red flag. Our generator encodes everything locally in your browser using JavaScript - your WiFi password, URLs, and contact data never reach our servers.
Which Code Type Eliminates Which Attack Surface?
| Attack Type | Dynamic Code | Static Client-Side Code |
|---|---|---|
| Sticker overlay | ⚠️ At risk - any printed code can be overlaid | ⚠️ At risk - physical surface attack applies to both |
| Server compromise | ❌ High risk - redirect server is a direct attack vector | ✅ No server - nothing to compromise |
| Generator data harvest | ❌ Server-side generators store your input | ✅ In-browser encoding - data never transmitted |
A static code generated client-side eliminates two of three attack surfaces. Physical overlay attacks apply to every printed QR code regardless of type - defence there is physical inspection.
What a Safe QR Code Generation Process Looks Like
- Use a client-side generator. No account creation. No cloud upload. The code builds in your browser. Download it directly.
- Verify the download. Open the downloaded file, scan it yourself, and confirm the URL preview matches exactly what you entered.
- Test in context. Print one test copy and scan it in the actual deployment location - the lighting conditions and scan distance of real use - before committing to a print run.
- For sensitive content (WiFi, vCard): Confirm the Network tab of your browser's developer tools shows no outbound request containing your data while encoding.
Our Free QR Code Generator encodes all content in-browser. No account, no upload, no server logging of your data.
If You Have Already Scanned a Suspicious Code
- Close the page immediately without filling in any fields or tapping any confirm buttons.
- Check your banking app for unexpected pending transactions. If you entered payment details, call your bank's fraud line - not any number on the suspicious page.
- Change any password of an account you may have accessed via the scan.
- Report it to the FTC at ReportFraud.ftc.gov and notify the business responsible for the code's location.
- If you downloaded anything: disconnect from WiFi, run your phone's built-in security scan, and consider a factory reset if any app installed itself without your consent.
For the location-by-location checklist of what to inspect before scanning in specific environments - parking meters, restaurants, email, workplaces - see our QR Code Safety Guide.