Privacy & safety

Are QR code generators safe? What actually happens to your data

Two different safety questions get confused constantly: whether the generator is safe, and whether the code is.

By Kiril Urbonas6 min read

It depends on where the code is generated and whether it contains a redirect. A client-side generator builds the code in your browser and never sees your content. A server-side one receives whatever you type, and a tool producing dynamic codes routes every future scan through its servers, logging the scanner’s IP, location, device and time.

Key takeaways

  • Two separate questions: what the generator learns when you create a code, and what the vendor learns every time someone scans it.
  • Client-side generators build the code in the browser — the content never reaches a server at all.
  • Any generator producing a dynamic or trackable code necessarily routes scans through its own domain, and necessarily sees the scanner.
  • A free generator that offers scan analytics is being paid in data. Work out which.
  • Check the code before trusting a tool: scan your own output and confirm it contains your content, not a shortened vendor URL.

Two different safety questions

“Are QR code generators safe” collapses two separate questions that have different answers, and conflating them is why the advice online is so muddled.

  1. What does the generator learn about me when I create a code? This is about where the code is built — in your browser, or on someone’s server.
  2. What does it learn about everyone who scans it, forever? This is about whether the finished code contains your content or a redirect through the vendor.

The second question matters far more, lasts far longer, and is almost never asked. A generator can be impeccable about the first and still put itself permanently in the path between your customers and your content.

What the generator sees when you create a code

It depends entirely on where the encoding happens, and there are only two architectures.

Where the code is builtWhat the vendor receivesHow to tell
In your browser (client-side)Nothing. The content never leaves the device.The preview updates with no network request; it keeps working offline.
On their serverEverything you typed — URL, Wi-Fi password, contact details.Each change triggers a request; the page breaks without a connection.
The two generator architectures

This is not a subtle distinction. If a tool renders the QR image on its server, it has necessarily received your content in order to do so. For a marketing URL that may not matter. For a Wi-Fi password or a full contact record it is a meaningful disclosure to a company you had not previously heard of.

Whether they retain it is a matter of policy rather than architecture — and policy can change, be ignored, or be rendered irrelevant by a breach. Architecture cannot.

What the vendor sees every time someone scans

This is the question that outlives the decision. If the generator produced a dynamic code, the pattern does not contain your URL — it contains a short link on the vendor’s domain. Every scan, for as long as the code exists, goes to their server first.

That means the vendor sees, for every person who ever scans your printed code:

  • Their IP address, and therefore their approximate location
  • Their device and operating system
  • The exact time of the scan
  • Which of your codes they scanned, and how often

None of that is a flaw. It is how the feature works: you cannot have scan analytics without someone collecting the scans. The problem is that it is frequently sold as a free bonus rather than as a decision you are making on your customers’ behalf.

How to check a generator yourself

You do not have to trust anyone’s claims. Four checks, none of them technical:

  1. Scan your own code and read what comes out. This is the decisive test. If your phone shows your URL, the code is static and nothing is in the middle. If it shows a short link on the generator’s domain, every future scan is being logged by them.
  2. Turn off your network and try to generate a code. A client-side generator keeps working. A server-side one cannot.
  3. Open the browser’s network tab while you type. If the content you are encoding appears in an outgoing request, it has left your machine.
  4. Look for an expiry or a scan limit. Free tiers that cap scans or expire codes are, by definition, dynamic — the vendor can only enforce a limit on something that passes through them.

A tool that passes all four cannot be tracking your users, whatever its privacy policy says, because there is no mechanism by which it could.

The other risk: scanning someone else’s code

Everything above is about generating. The more common consumer risk runs the other way — scanning a code someone else placed.

A QR code is an opaque link. You cannot read it before your phone does, which makes it a convenient wrapper for a destination you would not have clicked. Reported patterns include stickers placed over legitimate codes on parking meters and restaurant tables, codes in unsolicited emails and texts, and fake package-delivery notices.

Consumer alert

The US Federal Trade Commission has warned consumers that scammers hide harmful links in QR codes, including by covering legitimate codes in public places with their own stickers, and advises checking the URL before opening it.

Source: Federal Trade Commission, consumer alert · December 2023

Practical habits:

  • Read the URL preview before opening it. Both iOS and Android show the destination first — that preview is the entire defence, and it only works if you look.
  • Check physical codes for stickers. A code applied over another code is the single most common real-world attack, and it is visible to the naked eye.
  • Never enter credentials or payment details on a page you reached by scanning an unsolicited code. Navigate to the site yourself instead.
  • Be sceptical of urgency. “Your parcel is held”, “your account is suspended”, “scan to avoid a fine” are the standard framings.

Next: static vs dynamic QR codes, which covers the trade-off behind all of this, and what QRify is if you want the short version.

Frequently asked

Are free QR code generators safe to use?
Many are, but "free" has to be paid for somehow. A generator that builds codes in your browser costs almost nothing to run and can genuinely be free. One that offers dashboards, scan analytics and editable destinations is running infrastructure for every scan, and is usually monetising either subscriptions or the scan data.
Can a QR code generator steal my data?
A server-side generator receives whatever you type — including Wi-Fi passwords and contact details — because it has to in order to build the image. Whether it retains that is a matter of its policy rather than its architecture. A client-side generator cannot, because the content never leaves the browser.
How do I know if a QR generator is tracking scans?
Scan your own code and look at what it contains. If it opens your URL directly, it is static and there is nothing in the middle. If it opens a short link on the generator’s domain before redirecting, every future scan is being logged by that company — including the scanner’s IP address and approximate location.
Is it safe to scan a QR code someone else made?
Treat it like a link from a stranger, because that is what it is. The FTC has warned consumers that scammers place QR codes in emails, texts and on stickers over legitimate codes in public places. Check the URL your phone previews before opening it, and never enter credentials or payment details on a page you reached by scanning an unsolicited code.
Try it

QRify runs entirely in your browser. No account, no upload, no redirect — open the network tab and check for yourself.

Generate a code privately

Written by

Kiril Urbonas — builder of QRify, a free QR generator that runs entirely in your browser. Corrections and additions are welcome; this page is updated when the guidance changes.

Read next