Is it safe to scan QR codes at restaurants?
The short answer is yes — scanning a QR code at a restaurant is very safe in the vast majority of cases. QR code fraud at restaurants is rare, and legitimate restaurant QR menus do not pose any security risk to your device or personal data. However, there are a handful of simple checks that help you spot the rare exception and scan with complete confidence wherever you dine.
- Check that the QR code is printed or embedded directly by the restaurant — on the table, a tent card, a menu holder, or the restaurant's own signage; be skeptical of stickers placed on top of existing codes
- Preview the URL before opening it — most smartphones show the destination link before you tap to confirm; a legitimate restaurant menu will typically point to a recognizable domain like dishtup.com, not a random string of characters
- Look for HTTPS in the address bar — once the page loads, confirm the URL begins with https:// which means the connection is encrypted and the site has a valid security certificate
- Do not enter personal information — a legitimate QR code menu only shows you food and drinks; if a page asks for your name, email, credit card, or password just to view a menu, close it immediately
- Use your phone's built-in camera or QR scanner — these are safer than third-party scanning apps, which may have their own privacy issues; iOS and Android both scan QR codes natively through the camera app
- Trust your instincts — if the restaurant looks legitimate and the QR code is professionally printed as part of the decor or table setting, it is almost certainly safe; the risk is essentially zero in established restaurants
QR code fraud targeting restaurant diners is extremely uncommon — the overwhelming majority of QR menus at legitimate restaurants are completely safe. The tips above are good general digital hygiene practices, not warnings about a widespread threat. Dishtup menus are hosted on secure infrastructure with HTTPS by default, unique per-restaurant codes, and no personal data collection from diners.
Understanding QR code security — what the actual risks are
The concern about QR code safety typically comes from a type of attack called "QRLjacking" or "QR code phishing", where a malicious actor replaces a legitimate QR code with one that leads to a fraudulent website. In a restaurant context, this would mean someone physically covering the restaurant's printed QR code with a fake sticker. While this is theoretically possible, it is extremely rare and easily detectable: the replaced code will look out of place, and the destination URL will not match the restaurant's brand.
What a legitimate restaurant QR menu looks like
When you scan a genuine restaurant QR menu, you should see: a fast-loading webpage (not an app download prompt), the restaurant's name and branding prominently displayed, a list of menu categories and items with prices, and a URL from a recognizable domain. Platforms like Dishtup use a consistent domain structure so diners can recognize a legitimate menu page immediately. You should never be asked to create an account, provide an email, or enter payment information just to browse the menu.
Red flags to watch for before and after scanning
- A sticker placed on top of another code — this is the most common physical tampering method; always check if the code looks like it was added after the fact
- A URL with random characters or an unfamiliar domain — legitimate menus typically use branded domains or well-known platforms
- A request for personal data — no menu app should require a login, email, or payment details just to show you what's on offer
- An app download prompt — a genuine menu opens directly in your browser; be wary if scanning immediately triggers an app installation request
How Dishtup keeps QR menus trustworthy
Dishtup assigns each restaurant a unique, verified QR code that links to a page hosted on secure infrastructure with full HTTPS encryption. Menu pages load directly in the browser with no login required, no personal data collected from diners, and no tracking that compromises guest privacy. Restaurant owners manage their menus through authenticated accounts, so only they can modify what guests see. This architecture makes Dishtup menus among the most transparent and trustworthy QR menu experiences available.