For creators
Most creator risk is downstream of the payload. Prefer HTTPS links to properties you control. Avoid open redirects you do not understand. Do not encode internal admin URLs, password reset links, or API keys.
When using QRburst in the browser, generation stays on-device for typical Design Studio and toolkit flows. If you use the developer API, the payload is transmitted to QRburst’s servers to render an image and is handled as a stateless generation request—review that boundary before sending sensitive strings.
- Use short, stable HTTPS URLs when possible
- Prove destinations after print—codes can be swapped on physical materials
- Keep analytics and tracking parameters from exploding payload length unless you need them
Wi-Fi QR credentials
Wi-Fi QR payloads typically include network name, security type, and password in a structured string. Anyone who scans can recover those credentials with a standard decoder—there is no QR-layer confidentiality.
That convenience is fine for guest networks you intend to publish. It is a poor fit for sensitive corporate SSIDs, personal home passwords on public flyers, or any network where scan access should not equal join access. QRburst’s Wi-Fi tools warn about this exposure because it is intrinsic to the format.
For scanners
Phone cameras and QR apps decode first; visiting a link is a separate action on most modern systems. Prefer workflows that show the URL before opening it. Be skeptical of codes on temporary stickers over genuine signage, or codes in emails/messages from unknown senders.
Dynamic redirect short links deserve the same caution as any shortened URL: you may not see the final host until after a hop.
- Check for HTTPS and a recognizable domain when possible
- Do not enter passwords on sites reached from surprise codes
- Wi-Fi prompts from unknown codes can enroll you in hostile networks—confirm the SSID context
What QR codes are not
QR codes are not encryption. They are not a secure vault. They are not inherently malicious binaries—the risky part is usually the destination or the credentials encoded as text.
Security theater to avoid: claiming a styled QR is “tamper-proof,” assuming a logo makes a code trustworthy, or treating error correction as privacy. ECC recovers damaged modules; it does not hide payloads.
| Claim | Reality |
|---|---|
| “QR keeps data secret” | Payloads are readable by design |
| “QR infects phones on sight” | Codes encode data; harm usually requires opening a bad destination or joining a bad network |
| “Only dynamic QR is trackable” | Static URLs can still use your own analytics on the destination site |
| “HTTPS inside the QR encrypts the code” | HTTPS protects the web session after open, not the printed modules |