Stop posting photos with QR codes: cover them before you share

Sarah is off for a weekend at the seaside with two friends. At the airport she rests her phone on the café table, boarding pass open on the screen, next to her cappuccino and her sunglasses. She takes a photo, types “Here we go!” and posts it to her stories. Within minutes the first hearts start arriving.

Besides the cappuccino, the photo clearly shows a small square of black dots: the code on the boarding pass. To anyone looking, it is just a graphic detail. To anyone who points a phone at it, it is readable text, which in many cases contains the passenger’s name, the flight and the booking reference. With those details, you can often get into the “manage my booking” section of the airline’s website.

This recommendation — R24 of the Cyber Welfare Framework — suggests one simple habit around posting photos with QR codes: before you share a photo, check whether it contains QR codes or barcodes, and cover them completely. It is not about giving up sharing your moments. It is about removing the one part of the picture that means nothing to the people who look at it fondly.

What this recommendation says

Recommendation R24 states that a photo meant for social media should not contain readable QR codes or barcodes: if a code is in the frame, it should be cropped out or covered with a solid box before you post.

A QR code is a square of black and white modules that a camera translates into text: a web address, a number, a set of details. A barcode does the same thing with vertical lines, and usually holds less information. Both are designed to be read by a machine in an instant, even from a photo and even when they are small.

In practice, the recommendation rests on two moves:

• noticing the code: before posting, look at the photo for squares, stripes and printed numbers, in the background too;
• really removing it: crop the image or cover the code with an opaque rectangle, not with a light blur.

What it is not. It is not a call never to photograph tickets, parcels or badges: you can share them, as long as the code cannot be read. Nor is it about the QR codes you find out and about and decide to scan: that is a different topic, covered in the post on QR code attacks. And it does not deal with the location hidden inside photo files: that is the subject of the recommendation on turning off photo geotagging.

Where it applies. To posts, stories, profile pictures, groups and large chats; to personal photos and to those taken at work; to the images you post yourself and to those showing other people’s tickets or documents.

Why it matters

A QR code is not a drawing: it is a container. What is inside depends on whoever generated it, and it is often meant to be used by one person, at one moment: at the gate, at the entrance to a concert, at the office turnstile, when a parcel is delivered.

Here is what it may contain, depending on what you photographed:

• boarding pass: first name and surname, flight, seat and booking reference, sometimes a frequent flyer number;
• event or train ticket: the ticket itself, which in many cases is valid for whoever shows it first;
• work badge or access card: a personal identifier used to open doors or log in to systems;
• parcel label: tracking number, and often the recipient’s name and address;
• card with your home Wi-Fi: the network name and password, written in plain text inside the code.

The same goes for barcodes: they hold less than a QR code, but on tickets, labels and cards they often carry a booking reference, a tracking number or a personal identifier, such as a membership or health card number.

The problem is not that someone is looking for you. It is that a public photo is seen by many people, can be saved or captured in a screenshot, and stays available long after you have forgotten about it. It only takes one curious, or less than honest, person to scan it.

The concrete consequences show up on four fronts:

• bookings and tickets used by others — a seat changed, a flight cancelled, an entry already “used up” by the time you arrive;
• personal data exposed — name, address and identifiers ending up with strangers;
• more convincing fake messages — someone who knows your flight or your parcel can write to you pretending to be the airline or the delivery company, with real details and a link to a harmful website, as the resource on how to recognise phishing built to be convincing explains;
• unauthorised access — to your home Wi-Fi network or, in the case of a badge, to workplaces.

One case deserves special attention: the code for your home Wi-Fi. It is handy to print and stick up for guests, and it often ends up in the background of a photo taken in the living room. Whoever reads it gets the network password, which connects the phones, computers, cameras and smart devices of the whole household. How much that network matters is explained in the resource on home network security.

A concrete example

Back to Sarah. That evening, an acquaintance who started following her recently watches the story again, zooms in on the phone lying on the café table in the picture and scans the code with a reader app. Sarah’s surname and a six-character code appear on the screen.

On the airline’s website, in the section for managing a booking, those two details are usually all it takes. From there, depending on the airline, it may be possible to see the full itinerary, the email address and phone number entered at the time of purchase and, in some cases, to change the seat or the return flight.

There is no need to imagine the worst. It might just be a seat changed as a prank, or a message that arrives two days later: “Your return flight has been rescheduled, please confirm your details here.” The message quotes the right flight number and the right date, and that is exactly why it looks genuine. The effects of this chain are explored in the post on the consequences of posting a boarding pass.

The point where it all stops is the very first one: if the code had been covered in the photo, the story would have shown the same trip without leaving any door open.

When to apply it

The rule always applies, but there are moments when codes turn up more often.

• Before a trip. Boarding passes, train tickets, hotel bookings and travel documents are among the most shared photos, and among the richest in data.
• Before a concert or a match. The e-ticket is often the code itself: whoever copies it can try to get in before you.
• On your first day at work. The new badge, the desk, the view from the office: all photos in which an access card can remain readable.
• When a parcel you have been waiting for arrives. The classic “it’s finally here” shot often shows the label with the code, name and address.
• When you photograph your home. A house move, a newly decorated room, dinner with friends: the Wi-Fi card on the fridge or next to the router can appear in the background.
• When you share someone else’s photo. A friend’s ticket, a relative’s boarding pass: the code is theirs, but the choice to post it is yours.

How to apply it

You do not need to become a photo-editing expert. What you need is a short routine, always the same.

1. Look at the photo before posting it. Zoom in and look for squares, vertical stripes and printed numbers, including in the background, on screens and in reflections. Today’s cameras make even small codes readable.
2. Crop, if you can. Cutting the code out of the frame is the cleanest solution: what is not there cannot be read.
3. Otherwise, cover it with a solid box. Use an opaque rectangle or sticker that covers the whole code, edges included. A light blur or coarse pixelation is not enough: QR codes are designed to be read even when partly damaged, and some alterations can be reduced.
4. Cover the plain-text numbers too. Many codes have the same details printed underneath in letters and digits: booking reference, tracking number, card number. Cover them along with the code.
5. Post the edited version, not the original. Save the covered image as a new photo and make sure that is the one you upload. The original can stay on your phone, for you.
6. Choose carefully who sees the post. A smaller audience reduces the risk but does not remove it: a story for a few people can still be captured. Who sees your content also depends on who you accept as a contact, as the recommendation on connecting only with people you know explains.

Step-by-step techniques, from your phone’s photo editor to the tools already built in, are in the post on how to hide a QR code in a photo. If you would rather understand what is inside those dots, start with how QR codes work.

Common mistakes to avoid

• The token blur. A light effect makes the code look ugly, but not always unreadable to a machine.
• Partial covering. Hiding one corner or one strip is not enough: a QR code can be reconstructed even when a piece of it is missing.
• Forgetting the background. The star of the photo is the view or the dog, but the ticket on the seat or the Wi-Fi code on the shelf is still there.
• Thinking the story will disappear. Stories last a day, but a screenshot lasts for ever.
• Covering the code and leaving the numbers. The booking reference printed in plain text under the barcode says the same thing.
• Posting “after the trip” in the belief that it no longer matters. A used boarding pass can still show personal data, and a booking with a return flight is still active.

How this connects to the Cyber Welfare Framework

R24 brings security into an everyday gesture like sharing a photo: a short pause before you tap “Post”.

Digital maturity levels.

• FL1 — Basic. You post photos of tickets, parcels or badges without thinking about the codes. It is the most common starting point, not a fault.
• FL2 — Beginner. You notice the most obvious codes, such as boarding passes and tickets, and cover them with a solid box.
• FL3 — Autonomous. You check every photo, background included, and you also cover the numbers printed in plain text.
• FL4 — Skilled. You apply the same check to work photos and to those showing other people’s details, and you choose the audience for each post with care.
• FL5 — Expert-Guide. You help other people — in your family, among your friends, in your team — to do the same, kindly, when you notice a code on full display.

R24 is the key step from FL1 to FL2, and it remains an active habit at every level after that.

How to check you are applying it properly

Three questions, to be answered honestly.

1. Do the last few photos I posted show a QR code, a barcode or a booking reference?
2. When I cover a code, do I use a solid box that hides it completely?
3. Do I know where the code with my Wi-Fi password is at home, and whether it appears in my photos?

Quick checklist

• ☐ Before posting, I zoom in on the photo and check the background too
• ☐ I crop the code out when I can, otherwise I cover it with an opaque box
• ☐ I also cover the numbers printed next to the code
• ☐ I post the edited version, not the original
• ☐ The Wi-Fi card does not appear in photos of my home
• ☐ I ask permission before posting other people’s tickets or documents

If a box stays empty, you already have your next step. If you would like a more structured measure of where you stand, you can take the digital resilience self-assessment.

In short

QR codes and barcodes are made to be read in an instant, even from a photo. On boarding passes, tickets, badges, parcels and Wi-Fi cards they hold details meant for one person only: name, booking, access, password.

The solution is simple: look at the photo before posting, crop out or cover the code with a solid box, hide the plain-text numbers too, and post the edited version. A light blur is not enough.

Sharing a happy moment is still a lovely thing to do. Just leave out of the frame the one detail that tells nothing to the people who care about you, and speaks instead to those who should not be listening.

Something to think about. If someone scrolled through your latest photos today with a code reader in hand, what would they find?

Explore this recommendation

This recommendation is the pivot of a content unit. Each post looks at a different aspect.

• Risks of QR codes in photos — what gets hit, in terms of the confidentiality, integrity and availability of your data and your access
• Consequences of posting a boarding pass — the concrete effects on the operational, financial, legal, reputational and personal levels
• How to hide a QR code in a photo — the mitigations, from cropping to removing a post you have already published
• Signs someone used your QR code — the indicators to check and what they mean
• How QR codes work — what they contain, why they can be read even when damaged, and their limits
• QR code attacks — the ways codes are exploited to collect data or lead people to fake websites

Related resources

Short reads from the Resources section, for anyone who wants to focus on a single aspect:

• Home Network Security: The Router Nobody Configures
• How to Recognise Phishing When It Is Built to Be Convincing

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.