Funny QR Codes People Actually Scan, and the Habit That Keeps It Safe

A code stitched onto the back of a denim jacket is a good joke and a hard piece of manufacturing. A code piped into latte art is a good photograph and almost never a working code. Between those two sentences sits most of what happens when somebody sets out to make a funny QR code, and the gap between the idea and the scan is where the fun usually dies.

Jokes that actually work

The ones that land share a property: the destination is short, stupid and instant. Nobody waits four seconds for a punchline.

• A code on a shirt, sized for the distance people actually stand at. Across a table is fine. Across a bar is not.
• A business card whose code opens a fifteen-second video of you saying hello, which is more memorable than the card and much cheaper than a second meeting.
• A gift tag whose code plays a voice note instead of carrying a written message.
• A single joke page: one line of text, white background, nothing else. No cookie banner, no logo, no navigation. The restraint is the joke.
• A code on a conference badge pointing at a page that says what you are honestly there for, which turns out to be funny mainly because nobody else did it.
• The rickroll, which needs its own paragraph because it is the one people get wrong.

Latte art, icing, sand, cut vegetables and pressed flowers belong in a different category. They photograph beautifully and they scan about one time in ten, because the modules are neither square nor consistently dark. Build those for the picture, and put a working code somewhere else on the same object.

The rickroll is a manufacturing problem

Every version of this fails for the same reason, and it is never the joke. The video address is long, a long payload means more modules, more modules at one physical size means each module gets smaller, and small modules do not survive embroidery thread, a spray stencil or a vinyl cutter. Rickroll codes and why the patch on your jacket does not scan works through the whole chain, including how much a shortened link actually buys you and what a stitch does to a module edge. Read it before you order anything with a code on fabric.

Random codes to scan, and the catch

There is a real appetite for codes to scan purely for entertainment: puzzle hunts, museum trails, codes hidden in album art, a square in the corner of a poster that leads somewhere silly. That appetite is exactly what makes the rest of this post necessary, because from the outside a fun code and a hostile one look identical. A black and white square communicates nothing about where it goes. That is the entire design.

The part that makes this post worth reading

The cheapest attack anyone can run on a stranger is a printed square and some adhesive. There is no exploit in it, no malware, nothing for a vendor to patch. Somebody prints a code, sticks it over a real one on a parking meter, an electric vehicle charger, a restaurant table tent or a station poster, and waits. The victim does the whole job themselves: they scan it, they read a page that looks right, and they type in a card number.

The industry calls this quishing, and our page on QR code phishing sets out how the campaigns are actually run. The physical side, how the stickers get produced and where they turn up most, is on fake QR codes.

None of this argues for never scanning anything. It argues for one habit that costs two seconds.

What your phone shows you before it opens anything

Both major platforms preview the destination, and both truncate it.

On an iPhone, the Camera app decodes the code and puts a yellow notification near the bottom of the viewfinder with the address on it. Nothing loads until you tap that banner. The banner is narrow, so a long address is cut off partway through.

On Android the behavior depends on the phone. Most current camera apps surface a chip or a card carrying the address, and again nothing opens until you touch it. The code scanner tile in Quick Settings behaves the same way. Google Lens is slightly different: it shows the decoded content in its results panel rather than navigating anywhere, which makes it the most cautious of the three by accident.

The rule that survives the truncation is about where ownership lives in a web address. Read from the left until you hit the first single slash, then look at the last two labels before it. That pair is who controls the page. Everything to the left of it was chosen by whoever registered that pair, which is why an address can contain a bank's name three times over and belong to nobody you have ever heard of. Reading a code's link before you tap it goes through the lookalike tricks in detail, and what actually happens when you scan explains why the decode itself sends nothing anywhere, so looking is genuinely free.

The sticker over the sticker

If you inspect only one thing on a physical code, inspect its edges. A sticker applied over an original has a lifted corner, a slightly different white, a paper finish that does not match the surface around it, or a size that fails to line up with the printed frame underneath. Run a fingernail across the border. Operators print codes into their signage or laminate them flat; a fresh square of adhesive vinyl on a municipal meter is an anomaly worth thirty seconds of suspicion.

Two more signals, both about the page rather than the sticker. A payment flow that asks for full card details when the context implied a fixed amount through an app you already have is wrong. A page that wants you to install something, or to accept a configuration profile or a certificate, is wrong every single time, with no exception anyone has yet produced.

Make the joke, keep the habit

The two halves of this post are not in tension. Print the shirt, build the single joke page, put the video on the business card, hide a code in the wedding invitation. Then treat every code you did not place yourself the way you treat a link in mail from an address you do not recognize: read the destination in the banner, check the last two labels of the hostname, and only then tap.

If you want to build the joke properly rather than fight the tooling, a custom code with a short destination and a generous margin is a five-minute job, and shortening the destination is the single change that does most to make a hand-made code work.