Upload an image, paste a screenshot, or use your camera. You see the full link and its warning signs first, and nothing opens unless you click.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsDrop a QR code image here
Click to choose a file, or paste a screenshot (Ctrl+V / Cmd+V)
Is This QR Code Safe? Read the Link Before You Open It
A QR code hides its web address inside a pattern of squares, so you cannot tell where it leads until you scan it. Scammers rely on that. They stick fake codes over real ones or send codes by text and email, and the page behind them asks for your password or card number.
This tool decodes the code in your browser and shows the full address without opening it. You see the domain you would actually connect to, the path, and every query parameter, so you can compare them with what you expect.
It also checks the URL for common warning signs, including link shorteners, lookalike characters, an @ sign that hides the real host, and redirect parameters. The check reads only the structure of the address. It does not visit the site.
When to Inspect a Code Before You Scan It
Parking meters, pay stations, and posted signs
A sticker over the original code is a known trick. Scan the code here and confirm the domain belongs to the city or parking company before you pay.
Codes in texts, emails, and mailed notices
Messages about a missed delivery, an account problem, or a fine often include a QR code. Check where it really goes before you act on the message.
Images sent through chat or social media
Drop or paste the image on your computer and read the link there, instead of pointing your phone at it and tapping straight through.
Wi-Fi, contact, and other non-link codes
See the network name and security type, or the raw text of a contact or message, before you join the network or save the entry.
How to Preview a Scanned Link in 4 Steps
- Choose Upload Image or Use Camera. For an image, drop a file, click to choose one, or paste a screenshot with Ctrl+V (Cmd+V on Mac).
- The code is decoded in your browser, and its type is shown: web link, Wi-Fi, contact, email, phone, SMS, location, or text.
- For a web link, read the domain, path, and query parameters, then review any warnings listed below them.
- If the address looks right, click Open Link in New Tab. Otherwise, close the page and do not visit the link.
Note: The link opens only when you click the button.
What This Check Can and Can't Tell You
- The warnings are based on how the URL is written. The tool does not visit the site, follow redirects, or check lists of known scam domains, so a clean result is not a guarantee of safety.
- A flag does not prove a site is malicious. Some legitimate sites use short links, tracking parameters, or international characters.
- Short links are matched against a built-in list of common services, so an unlisted shortener will not be flagged.
- Camera access needs your permission in the browser. The video is decoded in your browser, and the camera turns off as soon as a code is found.
- The risk checks apply to links that start with http:// or https://. Other code types are displayed as plain contents.
URL Red Flags Checked on Every Scan
Each item below is checked when the code contains a web link. Matches are listed with a short reason.
| What is checked | Why it matters |
|---|---|
| @ sign before the host | Text before the @ is not the destination. The browser connects to the host after it. |
| Link shortener | The final destination stays hidden until you open the link. |
| Raw IPv4 address | Public links from real services normally use a domain name. |
| xn-- domain (IDN) | Lookalike characters can imitate a real domain (homograph attack). |
| Redirect parameters | Names like redirect, next, url, or continue can send you to another site. |
| Plain HTTP | The connection is not encrypted. |
| Domain ending (.zip, .top, .xyz, and similar) | Often seen in phishing, though some legitimate sites use them. |
| 3 or more hyphens in the domain | Lookalike names often pack in extra words and hyphens. |
| Deep subdomain chain | Long chains make the real domain easy to misread. |
| URL of 150+ characters | Too long to review by eye. |
These are warning signs, not verdicts. A flag means look closer, and no flag does not mean the site is safe.
How QR Code Scams (Quishing) Work and How to Spot Them
The common tricks behind malicious QR codes, and what to look for in the address.
Quishing: phishing delivered by QR code
Quishing combines QR code and phishing. The scammer swaps a clickable link for a code, so you scan it with your phone and land on a fake login or payment page. Because the address sits inside an image, you cannot read it by eye, and a text-based link filter may have nothing to inspect.
Stickers placed over real codes
The FTC has warned that scammers cover QR codes on parking meters with codes of their own. City officials have reported the same trick on pay stations and parking signs. If a code looks like a sticker, or the address does not match the official parking service, do not pay through it.
The @ trick in a URL
In a web address, anything before an @ is treated as login information, and the real destination is the host after it. A link such as https://[email protected]/ looks like PayPal but connects to example.net. This tool shows the host the browser would actually use.
Short links hide the destination
Services like bit.ly and tinyurl.com turn a long address into a short one, so the real destination is invisible until you open it. Short links are common in legitimate marketing too, so treat one as a reason to confirm who sent the code, not as proof of a scam.
Lookalike characters in domain names
Internationalized domain names allow letters from other alphabets. A Cyrillic "о" looks almost identical to a Latin "o", which lets scammers register a domain that reads like a real brand. Browsers convert these domains to a form that starts with xn--, and this tool flags any domain that does.
Common Mistakes With Unknown QR Codes
Paying through a code that is a sticker on a meter
The code sits on a sticker over the printed one, and you enter card details on the page it opens without looking at the address.
💡 See the solution▼
Trusting a familiar name at the start of the URL
You see a trusted brand at the front of the address and assume the link is real, without noticing that an @ sign or a long subdomain chain changes the actual destination.
💡 See the solution▼
Opening a short link from someone you do not know
The code leads to a shortened address, and you open it without knowing where it goes or who sent it.
💡 See the solution▼
Acting on a message that creates urgency
A text or letter says a payment is overdue or a package is on hold, and you scan the code and sign in before thinking it through.
💡 See the solution▼
Questions About Malicious QR Codes and Safe Scanning
Q.Can scanning a QR code harm my phone?
A. Reading a QR code only decodes a piece of text, such as a web address. The risk starts with what you do next: opening a link to a fake login page, entering a password or card number, installing an app, or joining a Wi-Fi network. That is why it helps to read the full address before you open anything.
Q.Does this tool open the link in the QR code?
A. No. It decodes the code and shows you the contents, and nothing is opened on its own. The link only opens in a new tab if you click the "Open Link in New Tab" button.
Q.How can I tell if a QR code is fake or malicious?
A. Look at the address it points to. This tool flags common warning signs: a known link shortener, a bare IP address, an @ sign that hides the real host, an xn-- (internationalized) domain, redirect parameters such as redirect or next, a plain HTTP connection, and a few domain endings often used in phishing. For printed codes, also check whether a sticker has been placed over the original.
Q.What is quishing?
A. Quishing is phishing that uses a QR code instead of a clickable link. The FTC has warned about scammers covering real QR codes on parking meters with their own, and about QR codes sent by text or email with a made-up reason to scan them, such as a missed delivery or an account problem.
Q.If no red flags are found, is the link safe?
A. Not necessarily. The check looks only at how the URL is built. It does not visit the site, read its content, or compare the address against lists of known scam sites. A brand-new fake page on an ordinary-looking domain can pass, so confirm the domain matches the company or service you expect before you enter any information.
Q.Can it expand a shortened link like bit.ly?
A. No. The tool never visits the link, so it cannot follow a short link to its final destination. It checks the domain against a built-in list of common shortening services (such as bit.ly, tinyurl.com, and t.co) and warns you when it finds one. The list does not cover every shortener.
Q.Is my QR code image or camera video uploaded anywhere?
A. No. The image or camera frames are decoded by your browser, and the tool does not upload them. Your scan history lives only in the open page and is cleared when you close or reload it.
Q.Does it work for Wi-Fi, contact, or text QR codes?
A. Yes, it shows the contents of the common types: web links, Wi-Fi networks, contacts (vCard), email addresses, phone numbers, SMS messages, locations, and plain text. For Wi-Fi codes it also lists the network name and security type. The red-flag checks run only on web links that start with http:// or https://.
Q.Can I check a QR code from a screenshot or a photo?
A. Yes. Upload or drag in any image your browser can display, such as PNG or JPG, or paste a screenshot with Ctrl+V (Cmd+V on Mac). Crop in tight and use a sharp, well-lit image if the code is not detected.
Q.Can I scan with my phone camera instead?
A. Yes. Choose "Use Camera" and allow camera access in your browser. The tool looks for a code in the live video, shows the result as soon as it finds one, and then turns the camera off.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.