In this article
There is a QR scanner inside Telegram, sitting beside the search field. Point it at a code and it works out what kind of code it is: a person, a group, a web address, or a request to log something in.
That last one is why this page is filed under security rather than convenience.
What you will be able to do
- check_circle Find the scanner without leaving the app.
- check_circle Tell what each kind of code will do before you point at it.
- check_circle Recognise the one code you must never scan.
- check_circle Check where a web code is actually sending you.
The camera opens inside Telegram, so what it finds is handled without a browser in the middle.
qr_code_2 A square that could be four different things
Every QR code looks the same. The pattern is just text, and the text decides whether you are about to open a chat, join a group, visit a website or authorise a login — four outcomes with wildly different consequences, none of which you can see by looking.
Scanning from inside Telegram helps a little with that, because the app can tell which kind it has found and shows you a screen appropriate to it rather than dropping you straight into a browser. A profile code becomes a profile; an invite becomes a group you can look at before joining.
What it cannot do is tell you whether the thing behind the code is worth reaching, and it is worth remembering that a printed code is the least verifiable object in ordinary life. Anybody with a sticker can cover the one on a poster, a parking sign or a table, and nothing about the replacement looks wrong.
Four codes, four outcomes
Identical squares. The difference only appears after you have already pointed the camera.
| What happens | What you give away | What to check | |
|---|---|---|---|
| Somebody's profile | Their profile opens, and you decide whether to message them | Nothing. Scanning is one-directional — they learn nothing about you until you write. | Only that the name matches the person in front of you. This is the safe end of the range. |
| A group or channel invite | A preview of the chat, with the option to join | Nothing until you join — and then your account becomes visible to whoever runs it. | Whether the group is what the poster claimed. Printed codes outlive the thing they advertised. |
| A web address | The page opens in the browser inside Telegram | Whatever you then type into it, which is the part worth slowing down for. | The domain, before you touch anything. A code is a link with the address hidden, which is precisely why it is used for fraud. |
| A login request | A device gets signed into your account | Everything. A session reads your whole history and can act as you. | That the screen showing it is yours. If somebody else produced this code, there is no safe version of scanning it. |
Three of these cost you nothing. The fourth costs you the account, and they look identical.
travel_explore Reading a web code before you trust it
When a code turns out to be a web address, the useful moment is the one before you interact with the page. Look at the domain in the address bar and read it from the end backwards — the part immediately before the first single slash is the site you are actually on, and everything to the left of it can be made to say anything.
This matters more with codes than with links because there is no text to be suspicious of. A link in a message at least shows you something; a code shows you a pattern, and by the time the page has loaded it has already had its best chance to look convincing.
The place this goes wrong most often is payment. A code on a table, a parking meter, an invoice, a delivery notice — all of them are easy to replace with a sticker, and the replacement leads to a page that looks correct and takes a card. Where money is involved, typing the address yourself costs ten seconds and removes the entire category of attack.
settings Using the scanner
- Open search and tap the code icon The camera opens inside Telegram.
- Let it tell you what it found A profile, a group, a page, or a login.
- Refuse every login code you did not produce No exceptions worth making.
- Read the domain before touching a page From the end backwards.
- Type the address yourself where money is involved Stickers are cheap.
- Scan theirs rather than showing yours With strangers you then owe nothing.
This page points a camera at a square. The curriculum step is what a login actually is: how a code or a code-by-message authorises a device, what an attacker needs from you to complete one, and how to check which sessions exist.
At a glance
- 1Built-in scanner
Scan QR codes from Telegram's own search or settings.
- 2Four kinds of code
Profiles, invites and web links are low risk; login codes are not.
- 3Never scan a login code
A login QR someone shows you signs them into your account.
Updated
