Is a QR code safer than an NFC tag?

They do the same thing

Both are a way of handing a phone an address without anybody typing it. Everything harmful that follows happens at that address, in a browser, and is identical either way.

So the security question is not which technology is safer. It is whether you look at where you are being sent, which is the same question in both cases.

Any comparison that concludes one is dangerous and the other is fine has usually compared a familiar thing with an unfamiliar one.

How they differ

A printed code can be tampered with by sticking a different code over it. That is easy, and it leaves something a careful person might notice: an edge, a mismatch, a sticker on a sticker.

A tag is tampered with by rewriting it or by placing another tag over it. Rewriting takes seconds and leaves nothing at all to see, and a second tag can be hidden behind a surface.

So a tag is worse for detectability and better for durability, since a printed code degrades in sunlight and a tag under a laminate does not.

Neither difference is large enough to make one a safe choice and the other a reckless one.

The preview question

People often say a code is safer because you can see the address before opening it. In practice most cameras show a truncated address for a moment, and few people read it.

A tag can be inspected too, deliberately, by reading it with an application that displays the content instead of acting on it. That inspection is more thorough than the camera preview.

Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.

So the advantage belongs to whichever one you actually inspect, and for most people that is neither.

The honest verdict

Choose between them on functional grounds: visibility, cost, whether the audience has NFC, whether the surface suits printing. Those are covered on the comparison page.

Treat both as untrusted, and apply the same habit to both: look at the destination before doing anything at it.

For a deployment, a tag beside a printed code is common and sensible, and it gives the visitor a route either way.

The one asymmetry worth acting on is that a tampered tag is harder to spot, so a public tag deserves locking and periodic inspection in a way a printed code does not.