Free Tools/QR Code Safety Checker
Where does that QR code actually go?
Nobody can read a QR code by eye, and scammers count on it: fake codes show up in emails, on invoices, even stickered over real ones on parking meters. Upload a photo of any code and see its destination before you ever open it.
Decoded on your device. The image is never uploaded, and we don't visit the link.
The red flags we look for
Hidden destinations
Link shorteners (bit.ly and friends) inside a QR code mean you can't see the real destination even after decoding. Legitimate businesses sometimes use them, but so does nearly every QR scam, precisely because they hide where you'll end up.
Lookalike and misleading addresses
A big brand's name in the middle of an unrelated web address (microsoft.account-verify.info) is the oldest trick in phishing. We check where the address actually leads, not what names appear in it.
Technical oddities
Raw IP addresses instead of names, unencrypted http links, international lookalike characters, and login-bait words in strange places. Each one raises the odds a code isn't what it claims to be.
Common questions
What is QR phishing ("quishing")?
Phishing that swaps the malicious link for a QR code. Because humans can't read a QR code by eye, and because codes often arrive printed (on parking meters, posters, invoices, or letters), they slip past both people and email filters that would have caught the same link written out. The destination is usually a fake login page or payment site.
How do I check a code I ran into out in the world?
Take a normal photo of it with your phone (don't open the link), then upload the photo here. We'll show you where it leads without visiting it. On most phones you can also long-press the camera's link preview to copy the address instead of opening it.
The checker says the destination looks OK. Is it safe to open?
"No obvious red flags" is not a guarantee. We can tell you where the code points and flag suspicious patterns, but we don't visit the page, and a clean-looking address can still host a fake login page. The reliable habit: if a QR code leads somewhere that asks you to log in or pay, stop and type the organization's address yourself instead.
Does my photo get uploaded anywhere?
No. The image is decoded entirely in your browser and never leaves your device. Nothing is uploaded, logged, or stored. You can load this page, disconnect from the internet, and it still works.
Phishing keeps finding new disguises
QR codes today, something else next quarter. Email protection, staff training, and monitoring keep your team ahead of whatever shape the next scam takes.