QR Code Decoder
See where a QR code actually goes before you point a phone at it. Upload or paste the image and it is decoded here in your browser — the destination is shown as text, and checked for the tricks used to disguise one.
Decoding happens entirely on your device. The image never leaves it and we store nothing.
Why a QR code is worth checking
A link in an email shows you where it goes, even if you have to hover to see it. A QR code shows you nothing at all. It is a picture of a destination, and the only way to read it is to point a camera and let the phone act on whatever it finds.
That gap is the whole attack. Stickers get placed over the codes on parking meters and restaurant tables. Codes arrive in emails precisely because the filters that inspect links cannot read images. Printed letters carry them because paper carries authority.
A QR code does not have to contain a web address. It can hold Wi-Fi credentials that join your phone to a network someone else controls, a phone number to dial, a prefilled text message to send, or a payment string. The check above reports what kind of payload it found, not just where it points.
What gets flagged
| Finding | Why it matters |
|---|---|
| URL shortener | The real destination is hidden behind a redirect, so what you see tells you nothing about where you land. |
| Non-ASCII characters in the domain | A lookalike domain using Cyrillic or Greek letters that resemble Latin ones. |
| Credentials in the URL | https://paypal.com@evil.com goes to
evil.com. Everything before the @ is ignored by the browser and read as
a username. |
| Plain HTTP | Unencrypted, and a login page served this way should never be used. |
| Bare IP address | Legitimate sites use names. A raw address usually means someone is avoiding leaving a domain trail. |
| Wi-Fi payload | Scanning joins a network chosen by whoever made the code. |
| javascript: or data: | Not a destination at all. There is no benign reason for either in a printed code. |
What this can’t tell you
- Where a shortener ends up. Following the redirect would mean fetching the URL from our servers, which turns this into a way to make us request arbitrary addresses. It reports that the destination is hidden and leaves it there.
- Whether the site is malicious. A perfectly ordinary URL can host a phishing page. This reads the code, it does not judge the website.
- Whether a sticker was placed over the original. No tool can. If a code in a public place looks added rather than printed, that is the signal.
- Codes it cannot see. A blurred, cropped or heavily angled photo may not decode. Retake it straight-on with the whole code in frame.
Habits worth having
| Situation | Better approach |
|---|---|
| Code on a parking meter or table | Check whether it is a sticker over the original. Use the official app or type the address instead. |
| Code in an email | Treat as you would an unexpected link. Images bypass the filters that check links, which is exactly why it arrived as one. |
| Code asking you to log in | Do not. Navigate to the site yourself and log in the usual way. |
| Your phone shows the URL before opening | Read it. Most phones display the destination first, and almost nobody looks. |
Once you know the destination, check the domain itself.
Lookalike Domain Checker WHOIS Lookup Scam TestFrequently asked questions
Can a QR code contain a virus?
Not directly — it is a short string of text, not a program. What it can do is send you somewhere that asks you to install one, or join you to a network where someone is waiting.
Is it safe to scan a code just to read it?
Reading is safe. The risk is what happens next, and phones vary in how much they ask before acting. Decoding the image here removes that step entirely.
Why does my code not decode?
Usually the image. Crop to the code, keep it square to the camera, avoid glare and make sure the quiet margin around it is included — that white border is part of the code.
Does the image get uploaded?
No. Decoding happens in your browser. Nothing is sent to us and nothing is stored.