A QR code is a container, not a website. Depending on the creator it stores a link, credentials, a contact card, a payment order or an industrial identifier. Knowing the content type lets you judge the risk of a scan before you open anything.
The six types you meet in daily life
URL codes are the most common case: the payload starts with https:// and leads to a web page. Text codes carry arbitrary strings, often serial numbers or notes. Wi-Fi codes start with WIFI: and deliver SSID, encryption and password. vCard and MECARD codes hold contact data. SEPA payment codes carry a transfer in the BCD format with IBAN, BIC and amount. GS1 codes structure data with application identifiers such as (01) for the GTIN.
The type decides what a useful result looks like. For a URL the domain is the essential fact, for Wi-Fi it is the password, for a vCard the phone number, for a payment code the amount and recipient. A good scanner shows those fields instead of dumping the raw string.
Why raw payloads are often unreadable
Payment codes are a good example. The payload is a multi-line string with service identifier BCD, version, character set, SEPA checksum, IBAN, BIC, amount and remittance text. Without a parser it is a wall of characters. GS1 Data Matrix is similar: leading zeros, variable field lengths and FNC1 separators make the raw form unusable for humans.
That is the difference between a camera app and a tool. The camera app shows the string; the tool shows the fields — and validates check digits at the same time, for EAN as well as payment codes.
Recognise risk before opening
A QR code cannot reveal where it leads before it is decoded. So the rule is: read first, decide second. Check the domain, watch for punycode (xn--), bare IP addresses, shortened links and brand names on foreign domains. If you scan a code in public, check whether the sticker was pasted over something else.
Our safety check flags these patterns but never opens a link automatically. The decision stays with you — which is the only way quishing does not become a habit.
FAQ
Frequently asked questions
Can a QR code contain a virus?
The code itself is only text. Danger comes from the link or file it points to — especially APK downloads on Android.
How do I recognise a Wi-Fi code?
The payload starts with WIFI: and contains fields such as T:, S: and P:. The scanner derives SSID, encryption and password.
Are SEPA payment codes safe?
They are a standardised transfer order. Always verify recipient and amount in your banking dialog — that is what actually executes.