Why keep a log of QR codes you scan
A single QR scan is a forgettable moment. A log of scans is a memory. Most people cannot say what they scanned last week, where they saw it, or whether the destination behaved oddly. That amnesia is exactly what a swapped code relies on: the same sticker, in the same place, quietly redirecting scanners for weeks while nobody connects the dots. A log turns isolated moments into a pattern — the same suspicious destination appearing at two locations, a code that changed its behaviour, a venue whose codes keep turning hostile.
The verdict is the most valuable field. Safe, suspicious, and blocked are judgements you make in the moment, when the context is fresh: the code was where you expected it, the page matched the promise, the redirect felt wrong, the login prompt arrived uninvited. Record the judgement even when you are unsure — especially when you are unsure. A suspicious entry you later revise is still more useful than a blank you cannot reconstruct. Over time, your own log becomes a personal reputation database for the places and senders whose codes you encounter.
For teams, a shared habit of logging is even more powerful. Facilities staff who log the codes they inspect, marketing staff who log the codes they publish, and support staff who log the codes customers report create a record that makes incidents tractable. When a customer reports a malicious code on a poster, the log answers the questions that otherwise take days: when was it last checked, what did it point at, who owned it, and which other codes share the same destination.
Keep the log honest and lean. Record the payload and the context, and never record credentials, tokens, or personal details — a log full of secrets becomes a target of its own. If a payload itself contains sensitive data, log a description instead of the full text. Export a CSV copy when the record matters, because browser storage is local, fragile, and tied to one device. And review the log on a schedule: suspicious entries deserve follow-up, blocked entries deserve a second look, and safe entries deserve a quiet confidence that your codes are behaving.
The deeper habit is the point. Logging a scan takes ten seconds, and it changes how you look at codes: from passive scanning to active noticing. You start to see the sticker that was not there yesterday, the code whose frame does not match, the destination that drifted. That attention is the real defence — the log is just where it accumulates.