Two separate things happen, and only the second involves the internet. The decode is arithmetic your phone performs on the pattern itself, so no server is contacted, and if you never tap, nothing about that scan exists anywhere outside your device. Tapping makes it an ordinary web visit, where the site sees an IP address, a user agent and a timestamp; a dynamic code adds one redirect hop that counts the scan on the way through.
You point your phone at a sticker on a parking meter. Half a second later a link appears at the bottom of the screen and you have to decide whether to tap it. That half second is where most people's mental model of QR privacy either forms or goes wrong.
Two separate things are happening, and only one of them involves the internet.
The decode happens on your phone and goes nowhere
A QR code is not a link. It is a picture of text. The black and white squares are a binary encoding with error correction baked in, and turning that pattern back into characters is arithmetic performed by the camera app on your device. No server is contacted to look up what the code means, because there is nothing to look up. The data sits in the ink.
That has a consequence people rarely state plainly: the moment of scanning is invisible to everyone. Whoever printed the code has no idea you pointed a camera at it. Your phone did some math and showed you a string. If you never tap, the story ends there, and nothing about that scan exists anywhere outside your device. It is also why a QR code scanner still decodes perfectly with the network switched off. If you want the encoding side of it, what a QR code actually is walks through the structure.
After you tap, it is an ordinary web visit
Say the payload is a plain URL and the code is static, meaning the printed pattern encodes the destination directly. Tapping opens your browser to that address, and from the site owner's side you are a normal visitor. They see roughly what any web server sees:
- an IP address, which resolves to a city or region rather than a street
- a user agent string: operating system, browser, rough device class
- a timestamp
- whichever pages you visit next on their site
- usually no referrer, or a blank one, since you did not arrive from another page
That last item is the only thing that mildly distinguishes a QR arrival from someone typing the address by hand. Some organizations add a tracking parameter to the printed URL so they can tell the poster campaign apart from the email campaign. That is a label attached to the visit, not a label attached to you.
A static code has no middle step at all. Whatever tracking happens, the destination site is doing it, exactly as it would if you had found the link on a business card.
A dynamic code adds one hop and one record
Dynamic codes encode a short redirect URL instead of the final destination. Tap one and your browser makes a brief stop at the redirect service before continuing. That stop is the scan event, and it is the only reason dynamic codes can report analytics.
What gets written down at that hop is approximately:
- a count, incremented by one
- the time
- coarse location derived from IP, usually country and city
- device type and OS family
- sometimes the referring app, if the operating system passes one along
Then the redirect fires and you land on the destination, typically in under a second. The code's owner now knows their poster at the train station got four hundred taps on Tuesday and most were on iOS. They do not know it was you. There is no identity in a scan to begin with.
What a scan does not reveal
Worth being blunt here, because the folklore runs hot.
Your name, email, or phone number. None of it is transmitted by scanning. A web request carries no identity unless you type identity into a form.
Your contacts, photos, messages, or files. A camera reading a pattern has no path to any of that. Reading a code installs nothing.
Your precise location. IP geolocation is a neighborhood guess at best and is frequently wrong by an entire city, especially on mobile carrier networks. Anything closer requires a browser permission prompt you would have to accept.
Your other apps. The scan is a camera operation followed by a browser request. It has no visibility into the rest of the device.
Control of your phone. A QR code cannot execute anything. It hands your operating system a string, and the operating system decides what to do with it.
The persistent myth that scanning gives someone access to your phone comes from collapsing two steps into one. The scan is inert. The tap is the decision.
Where the real risk lives
None of that means QR codes are automatically safe. The pattern is a delivery mechanism, and a delivery mechanism carries whatever somebody puts inside it.
The realistic attacks are the ones that would work with any link. A destination imitating a payment page and collecting a card number. A login screen dressed as your bank. A page requesting app permissions you would never grant if you read them carefully. A file download disguised as a menu PDF. And the physical version, which is the most common of all: a sticker placed over a legitimate code on a parking meter, a restaurant table, or a charging station.
None of these are properties of the square. They are properties of a page you decided to trust because a printed code implied somebody official put it there. Fake QR codes and how they get planted goes through the specific patterns.
Reading the URL before you tap
The defense is small, boring, and effective.
Read the domain in the preview from right to left. The part immediately before the first single slash is the real host. A link at yourbank.com.secure-login.xyz belongs to secure-login.xyz.
Touch the sticker. A code taped or stuck over another one is the clearest warning sign in the wild and takes a second to check.
Urgency deserves suspicion. Codes promising a fine, a refund, or a prize are aimed at your reflexes rather than your judgment.
Credentials and card details never go on a page you reached from a printed code. Open the app or type the address yourself. The inconvenience costs thirty seconds.
Shorteners deserve a little extra care, not panic. A redirect is normal for dynamic codes and legitimate campaigns; it simply means you cannot judge the destination until you arrive, so judge it then.
If you scan and the page looks wrong, close it. Nothing has happened yet. The scan gave away nothing, the visit gave away about what any visit gives away, and walking away costs you one tap. Scanning safely, step by step has the per-device instructions if you want them.