Guides
How to scan a QR code safely on iPhone
Scan QR codes safely on iPhone, check the displayed domain before opening, spot quishing scams, and know when Camera or a scanner with history is the right tool.
Last updated June 22, 2026
Direct answer
Open Camera, frame the QR code, and pause before tapping the detected link. If the displayed domain looks wrong, the code was unexpected, or the page asks you to log in or pay, close it and go to the organization’s official app or website yourself.
Why “just point the camera” is not always enough
A QR code is opaque — the link is hidden in the pixels, so you cannot judge it the way you would a typed-out web address. Attackers exploit that. Quishing (QR + phishing) puts malicious codes on parking meters, fake parcel-delivery slips, café table tents, and email attachments. The code opens a spoofed login or payment page, and by the time you see it, you have already tapped through.
The built-in iPhone Camera shows the detected link before opening it, but it is easy to tap by reflex. Reading the displayed domain first is the single most useful habit for avoiding QR scams.
Use the built-in iPhone scanner first
For an ordinary QR code, you do not need another app. Apple’s current workflow is to open Camera, hold the iPhone so the code appears in the frame, then tap the detected link. You can also add Code Scanner to Control Center. See Apple’s current QR scanning instructions.
Use a dedicated scanner when you need a searchable scan history, want to scan a code from a saved photo, need additional barcode formats, or want to generate a QR code.
Safe scan checklist
| Situation | Safe move |
|---|---|
| Code in a public place (meter, poster, flyer) | Treat as unverified. Check the displayed domain before opening. |
| ”Delivery failed — rescan to reschedule” | Almost always a scam. Go to the carrier’s app or site directly. |
| Page asks you to log in or pay right after scanning | Stop. Navigate to the real site yourself; never enter credentials from a QR link. |
| Shortened or unfamiliar domain | Treat it as unverified. Use the organization’s official app or type its known address yourself. |
| Wi-Fi QR code at a hotel or café | Confirm the network name with staff before joining. |
Keep a history and scan codes from photos.
Swarmval QR Scanner adds scan-from-photo, searchable history, eight supported code formats, and built-in QR generation.
FAQ
Is it safe to scan random QR codes? +
Not always. QR phishing — "quishing" — hides a malicious link behind the code. Check the displayed domain before opening it, and never enter passwords or payment details on a page you reached from an unexpected code.
What is quishing? +
Phishing delivered through a QR code — on fake parking meters, fake delivery notices, table tents, and email attachments. The code leads to a spoofed login or payment page, while its destination stays hidden until the code is scanned.
Does the iPhone Camera show the link first? +
Yes. Camera shows the detected link before opening it. Pause and read the displayed domain before tapping. If the code was unexpected or the domain looks unfamiliar, use the organization’s official app or website instead.
Do I need to pay for a QR scanner app? +
No. Apple’s built-in Camera and Code Scanner handle ordinary QR codes. A dedicated scanner is useful for scan history, scanning from saved photos, additional barcode formats, or QR code generation.
Related pages
- QR Scanner for iPhone
- Password Generator — strong, on-device passwords
- Authenticator (2FA) for iPhone
- All Swarmval apps
Steps
-
Step 1
Open your scanner and frame the code
Point the iPhone Camera (or QR Scanner) at the code from 6–12 inches away. Good light and a steady hand help it lock on instantly.
-
Step 2
Read the full URL before you tap
Read the displayed link before opening it. Check the domain — is it the company you expect, or a look-alike like "app1e-pay.com"? Treat shortened or unfamiliar domains as unverified.
-
Step 3
Stop if anything feels off
Unexpected code in a public place, a "your package failed" notice, or a request to log in or pay? Close it. Legitimate businesses rarely force a login through a random QR code.
-
Step 4
Only enter details on a verified site
Never type a password, card number, or 2FA code on a page you reached from an unsolicited QR code. Navigate to the company's site directly instead.
-
Step 5
Keep a history you can audit
Use a scanner that logs what you scanned. If a code later turns out to be malicious, you can see exactly where it pointed and what you opened.
Frequently asked questions
Is it safe to scan random QR codes?
Not always. QR phishing — called quishing — hides a malicious link behind the code. Check the displayed domain before opening it, and never enter passwords or payment details on a page you reached from an unexpected code.
Does the iPhone Camera show the link before I open it?
The Camera app shows the detected link before you open it. Pause and read the displayed domain before tapping. If the code was unexpected or the domain looks unfamiliar, do not open it; visit the organization’s official app or website directly.
What is quishing?
Quishing is phishing delivered through a QR code — on fake parking meters, fake delivery-failure notices, restaurant table tents, and email attachments. The code leads to a spoofed login or payment page, while its destination stays hidden until the code is scanned.
Do I need an app to scan QR codes on iPhone?
No. Apple’s built-in Camera and Code Scanner can scan QR codes. A dedicated app is useful when you need scan history, scanning from a saved photo, more barcode formats, or QR code generation.