Upload a QR image — we decode it in your browser to reveal the content, and if it is a link, run a risk check automatically. Nothing is uploaded.
Free with no sign-up, and the check runs inside your browser, so what you enter never leaves your device. The result is a signal to help you decide, not proof for money or legal decisions.
Upload a QR-code image and it decodes the link inside directly in your browser, then automatically checks that link for phishing/scam risk. QR codes are dangerous precisely because you cannot see the destination with your eyes.
A QR code hides its destination from the human eye. Sticker QR codes stuck on café tables, parking meters, shared scooters or fake utility bills — placed over the real one — are on the rise. The instant you scan, you are on a fake payment or login page.
This tool never uploads the image; it decodes the QR inside your browser and then evaluates the resulting URL with the link-check logic. So you can safely preview the destination before you scan.
If a URL is extracted from the QR, that address is fed straight into the link-risk check and its score and reasons are shown. If it contains text, a contact or Wi-Fi details rather than a URL, those are displayed as-is.
For a QR that leads to payment, transfer or login, be extra suspicious regardless of the score — physical sticker QR codes are especially easy to tamper with.
Most QR fraud is not clever hacking; it is a sticker placed over printed material. Parking payment machines, EV chargers, table-ordering codes in restaurants, shared scooters and notices on public boards are all targets. A sticker cut to the same size over the original is hard to notice.
So the first check is physical. Look for a lifted corner, paper texture or gloss that differs from the print around it, a second layer you can feel with a fingernail. A separately applied code sitting next to one printed into the notice is itself a warning.
Fake penalty and utility notices posted through letterboxes work the same way. Do not pay through the code on the notice; go to the institution's official app or a payment route you already know and check whether the charge exists. The phone number printed on the notice is forged too, so find that number somewhere else.
A QR code is just a container for a string, so it carries more than URLs — contact cards, Wi-Fi credentials, draft messages and payment-format strings among them. This check hands anything that is a URL to the link risk analysis and shows other formats as-is.
Wi-Fi codes deserve particular care. Scanning one joins a network of the named SSID, which makes it a convenient way to push people onto a lookalike access point in a cafe. Confirm the network name against the venue's own signage, and never sign in or pay on an unfamiliar network.
One principle makes the rest easy. A QR code carries no signature and no encryption; nothing inside it attests to who made it. "Is this QR genuine?" therefore cannot be answered by examining the code — only by a person checking where the contents lead. That is why this tool shows you the contents instead of scanning straight through.
A notice imitating an official form came by mail, with a payment QR code and a contact number printed at the foot. The amount was small enough not to invite scrutiny. The code led to an unfamiliar payment page rather than an institutional domain, and the check flagged both the domain mismatch and a recently created host. The lesson in this type is that the printed phone number is forged too — verification calls have to go to a number you found independently.
A QR sticker on a parking kiosk was photographed and uploaded. The decoded address belonged to a domain unrelated to the operator and imitated a payment page. The link check returns high risk. A QR code’s only real weakness is that the destination is invisible to the eye, and this tool exists to make that hidden address visible.
A laminated table-menu QR was uploaded. It decoded to the chain’s official domain on its menu path. No risk signals, low grade. One physical check still matters: whether the sticker has been applied on top of the printed code, which is how the swap attack works.
If the encoded address passes through a legitimate shortener or ad-tracking hop, string analysis cannot see the final destination and no risk signal fires. "Low risk" means "nothing bad was found in this string", not "this is safe". When a payment or login screen opens, check the domain in the address bar again at that moment.
No. Decoding happens inside your browser and the image is never transmitted.
Yes. Capture the QR shown on screen and upload it; if the code is sharp it usually decodes.
Some devices open scanned links automatically. You can usually change that in settings so the address is shown first; if that is awkward, screenshot or photograph the code and upload it here instead.
QR codes carry error correction, so a partly obscured code often decodes. Bad focus or a steep angle is what breaks it. Reshoot square-on and crop so the quiet margin around the code is included.