QR Code Security: How Quishing Works and How to Stay Safe
Malicious QR codes are a real and growing problem. What the attacks look like, and what both scanners and publishers should do.
The long-form end of this blog. These are the articles to read once, properly, before you commit a code to print — the ones covering how the format actually behaves rather than which button to press.
They lean on specifics: the module density a phone camera can still resolve, why raising error correction makes a code harder to scan rather than easier, what a scan log can and cannot tell you. If you are deciding something you cannot undo once the artwork ships, start here.
Malicious QR codes are a real and growing problem. What the attacks look like, and what both scanners and publishers should do.
Most QR scanning failures come down to three fixable things: size, contrast, and error correction level. Here is what actually matters.
A default black-and-white QR code works, but a branded one gets scanned more. Here is how to customize yours without breaking it.
How to plan a spreadsheet, turn it into up to 100 QR codes in one pass, and check the batch before it goes to print, so every table, tag, and badge scans.
Every iPhone since 2017 and most Android phones since 2018 can scan a QR code with nothing but the built-in Camera app. Here is exactly how, on both platforms, and what to do when it does not work.
A barcode and a QR code look like cousins, but they solve different problems. The real differences are capacity, scan direction, and error correction — here is what each actually means in practice.
Static codes encode the destination directly; dynamic codes point at a redirect you control. The difference matters most after printing.
Scan counts alone tell you very little. Here is how to read QR analytics in a way that changes decisions.
A checklist for diagnosing a QR code that will not scan, ordered from the most common cause to the most obscure.