QR Codes: How to Make One and How to Scan One Safely

October 17, 2026 • NOFYI Editorial Team

Introduction: A Square That Opens a Door

A QR code is that black-and-white square you see on menus, posters, tickets, receipts, and product packaging. Point your phone camera at it, and it can open a website, show a menu, connect you to Wi-Fi, or add a contact. It feels like magic, but it is just a machine-readable pattern that stores information.

QR stands for Quick Response. The code was invented in Japan in the 1990s for tracking car parts. It became popular worldwide because smartphones made it easy to scan. Today, QR codes are everywhere, which is why it helps to understand what they can hold, how to make one, and how to scan one safely.

This guide is practical. You will learn what a QR code holds, the difference between static and dynamic codes, how to create one step by step, how to scan one on iPhone and Android, and how to avoid quishing, the phishing attack that uses QR codes.

What a QR Code Holds

A QR code stores data as a pattern of dark and light modules. Your camera reads the pattern and decodes it. The data can be many things:

A website URL, such as https://example.com
Plain text, such as a short message or a serial number
A Wi-Fi network name and password, so a guest can join without typing
Contact details, often in vCard format, to save a person to your address book
An email address, phone number, or SMS message with pre-filled text
A payment request or a link to a payment page
A location, an event, or a link to download an app

Most QR codes you meet in daily life hold a URL. When you scan it, your phone shows the URL and asks if you want to open it. That preview step is your main safety check, as explained below.

QR codes have a capacity limit. The more data you put in, the denser the pattern becomes. A dense code is harder to scan, especially if it is printed small or damaged. For that reason, short URLs and short text work best. QR codes also include error correction, which means a code can still be read even if part of it is scratched, dirty, or covered. Higher error correction makes the code more robust but also denser.

Static vs Dynamic QR Codes

This is the most important distinction when you create a QR code.

Static QR codes

A static QR code stores the data directly in the pattern. If you encode https://example.com, the pattern contains that URL itself. The code works forever, as long as the destination still exists. You cannot change the destination later. If you print a static code on 1,000 flyers and then change your website address, you must reprint the flyers.

Static codes are simple, free in many generators, and do not depend on a third-party service staying online. They are a good choice for a stable link, a personal contact card, or a Wi-Fi login that will not change often.

Dynamic QR codes

A dynamic QR code stores a short redirect link that points to a service. That service then forwards the scanner to your real destination. You can change the destination later without reprinting the code. Many dynamic services also offer scan counts, locations, and times.

That convenience has trade-offs. Dynamic codes depend on the provider. If the provider shuts down, changes its terms, or stops your account, your code can stop working or go to the wrong place. Some dynamic services are free for a trial and then charge. Others collect analytics about scanners. If you use a dynamic code for a business, read the terms, check who controls the redirect, and consider what happens if you stop paying.

Rule of thumb: use static codes for stable, long-lived content. Use dynamic codes only when you genuinely need to change the destination or track scans, and only with a provider you trust.

How to Make a QR Code: Step by Step

Step 1: Decide what the code should do

Write down the exact action. Is it “open my homepage,” “show the menu PDF,” “join the guest Wi-Fi,” or “save my contact details”? A clear goal prevents a vague code that confuses people.

Step 2: Choose static or dynamic

For most personal and small-business uses, static is enough. Choose dynamic only if you need to update the link later or track scans.

Step 3: Use a trustworthy generator

Use a well-known generator, your phone’s built-in sharing feature, or a reputable tool you already use. Avoid random generators that ask for unnecessary personal information, require you to create an account for a simple static code, or promise free dynamic codes with unclear terms. If a generator wants your email for a basic static code, look for another one.

Step 4: Enter the data carefully

Type the URL exactly. Use https:// at the start. Check for typos. A single wrong character sends people to the wrong site, or to a site that does not exist. For Wi-Fi codes, double-check the network name, password, and security type. For contact codes, check the phone number and email.

Step 5: Generate and test the code

Generate the code and scan it yourself with two different phones if possible, one iPhone and one Android, or two different camera apps. Check that the preview shows the correct URL and that opening it lands on the right page. Test at the size you will print, not only on a large screen.

Step 6: Print or display it well

Print the code large enough to scan from the expected distance. A code on a poster seen from two metres away needs to be much larger than a code on a business card held in the hand. Keep quiet space around the code, the blank border called the quiet zone. Do not stretch, crop, or place text over the code. Use high contrast: dark code on a light background works best. Avoid glossy reflections and curved surfaces that distort the pattern.

Step 7: Add a short label

Tell people what will happen when they scan. For example: “Scan to view the menu” or “Scan to visit example.com.” A label builds trust and helps people decide whether to scan.

Worked Example: A QR Code for Example.com

Let us make a simple, safe example. Suppose you want a QR code that opens https://example.com, the standard example domain used in documentation.

Goal: Open https://example.com when scanned.

Type: Static, because example.com is stable and you do not need to change it or track scans.

Steps:

Open a trusted QR generator and choose URL or Website.
Type exactly: https://example.com
Generate a static QR code. Download it as a PNG or SVG for print.
Scan the code with your phone camera. Your phone should preview “https://example.com” before opening anything.
Tap the preview only if it matches what you typed. The browser should open the example.com page.
Print a test copy at the size you plan to use and scan it again from a normal distance.

If the preview shows anything other than https://example.com, do not open it. Delete the code, retype the URL, and generate a new one. This test is the same check you should use for any QR code you scan in the real world.

How to Scan a QR Code

On iPhone

Open the Camera app, point it at the code, and hold steady. A yellow notification or link preview appears near the code. Tap it only after you have read the URL. You can also use the Code Scanner in Control Centre. Do not tap a preview that looks unfamiliar or misspelled.

On Android

Open the Camera app or Google Lens, point it at the code, and wait for the link preview. On some phones, you can also scan from the Quick Settings tile or from the Google app. Again, read the preview before tapping.

If your camera does not scan

Make sure the camera is in focus, the code fills enough of the frame, and there is enough light. Move closer or farther away. Clean the lens. If the code is on a curved bottle or a shiny surface, try a different angle to reduce glare. If it still does not scan, the code may be too small, too dense, or damaged.

How to Scan Safely: Quishing and Other Risks

Quishing is phishing using QR codes. An attacker puts a malicious QR code where you expect a trusted one, hoping you will scan it without checking. Because you cannot read a QR code with your eyes, you cannot tell where it goes until your phone shows the preview.

Common quishing tricks include:

A sticker placed over a real QR code on a parking meter, poster, or restaurant table. The sticker looks genuine but points to a fake payment or login page.
A QR code in an email or message that claims your account is locked, your parcel is delayed, or you have won a prize. The code bypasses the usual email link checks because the URL is hidden in the image.
A QR code that opens a fake login page that copies a bank, email provider, or social network. If you enter your password, the attacker steals it.
A QR code that triggers an action you did not expect, such as joining a Wi-Fi network, sending a message, or downloading an app.

Safety rules

Check the context. Does the code make sense where you found it? A parking meter should link to a parking payment page, not to a free gift card offer.
Look for tampering. Check for stickers over the original code, peeling edges, mismatched printing, or a second code pasted on top. If a code looks added later, do not scan it.
Read the URL preview before opening. Your phone shows the destination before you tap. Read the whole domain. Look for misspellings, extra words, strange subdomains, or a URL shortener hiding the real destination. If it does not match what you expect, close it.
Never enter passwords after scanning an unsolicited code. If a QR code takes you to a login page you did not expect, close it and go to the official app or type the official address yourself.
Do not scan random stickers. A QR code on a lamppost, a random flyer, or a stranger’s social media post is not worth the risk. If you are curious, search for the organisation’s official site instead.
Be careful with Wi-Fi and payment codes. Only join Wi-Fi from a code you trust, and only pay through a code shown by the actual merchant in front of you. Check the amount and recipient before confirming any payment.
Keep your phone updated. Updates fix camera and browser security issues. Use your phone’s built-in scanner rather than installing an unknown QR scanner app that asks for excessive permissions.

What to Do If You Scanned a Suspicious Code

Do not panic, but act quickly. If you only saw the preview and did not open it, you are usually safe. If you opened a page, close it. If you entered a password, change that password from the official app or website, and change any other accounts that used the same password. Turn on two-factor authentication where available. If you entered payment details, contact your bank or card provider. If you downloaded an app, delete it and run a security check. If you are unsure, ask a trusted person or your organisation’s IT support for help.

Limitations

QR codes are convenient, but they have limits. They are not secure by themselves: anyone can create a code that points anywhere, and the pattern gives no visual clue about the destination. Dynamic codes depend on a third-party service that can change, fail, or collect data. Dense codes are hard to scan when printed small, damaged, or on curved or reflective surfaces. QR codes do not work without a camera and a screen reader alternative may be needed for accessibility. Always provide a plain text link or alternative next to a QR code for people who cannot or do not want to scan it. This guide gives general information, not legal or security advice for a specific business or high-risk situation. If you handle payments, health data, or sensitive personal data, get professional advice before relying on QR codes.

Frequently Asked Questions

What does a QR code actually store?

It stores data such as a URL, text, Wi-Fi details, or contact information in a pattern of dark and light squares. Most everyday codes store a URL. Your phone decodes the pattern and shows a preview before opening anything.

Should I use a static or dynamic QR code?

Use static for a stable link you will not need to change. Use dynamic only if you need to update the destination later or track scans, and only with a provider you trust. Dynamic codes depend on the provider staying online and honouring its terms.

Is it safe to scan any QR code I see?

No. Do not scan random stickers or codes in unsolicited messages. Check for tampering, read the URL preview carefully, and never enter passwords on a page you reached from an unexpected code. When in doubt, go to the official app or type the official address yourself.

Can I make a QR code for free?

Yes, many reputable generators offer free static QR codes. You usually do not need an account for a simple static code. Be cautious of generators that require personal information for a basic code or hide the cost of dynamic codes.

Conclusion

QR codes are a fast way to share a link, a menu, a contact, or Wi-Fi access. Make them carefully: choose static unless you need dynamic, type the URL exactly, test the code, and label it clearly. Scan them carefully: check the context, look for tampering, read the URL preview, and never log in from an unexpected code. The worked example with example.com shows the whole process in miniature. Use it as your template, and you will get the convenience of QR codes without taking unnecessary risks.