QR Code Safety Scanner

Find out where a QR code really goes before you open it. We decode the code, show the real destination, and check the link for common scam patterns. Links never open automatically.

  • No sign-up
  • No app to install
  • Nothing is uploaded
  • Instant result

Scan or upload a QR code

Upload an image
Photo or screenshot · drag & drop or paste (Ctrl/⌘ + V)
Or paste a link you want to check

The verdict and the real destination appear here. Nothing opens until you choose.

  • Private by designEverything runs in your browser. Your data is never uploaded.
  • Works offlineOnce loaded, the tool works without an internet connection.
  • Spots risky linksLook-alike domains, link shorteners and phishing words are flagged.

How to check a QR code before opening it

  1. Scan the code or upload a photoTap "Scan with camera" and point it at the code, or upload a screenshot or photo.
  2. Read the real destinationWe show the full link and highlight the real website name, the part that decides where you end up.
  3. Check the verdict and reasonsSafe, Caution or Risky, with the specific warning signs we found.
  4. DecideCopy the link, open it anyway, or walk away. When in doubt, type the company's address yourself.

Why check a QR code first?

Criminals stick fake QR codes on parking meters, EV chargers and restaurant tables, and send them in emails and letters that look official. This is called quishing (QR phishing). The code leads to a convincing copy of a real website and asks for a card number, a bank login or a "small fee". Because you can't read a QR code with your eyes, you only see the link after your phone has started loading it.

This scanner reverses that. It decodes the code, shows you the full destination and checks it, and it never opens anything on its own.

What we check

  • The real domain. In paypal.account-verify.com the real website is account-verify.com, not PayPal. We highlight the part that matters.
  • Look-alike characters. Domains that use Cyrillic or other foreign letters to imitate a brand (punycode, shown as xn--).
  • Brand impersonation. Bank, payment, delivery or tech brand names in a domain that the brand doesn't own.
  • IP addresses instead of a domain name.
  • Link shorteners and redirect services that hide the final destination.
  • Cheap, frequently abused domain endings such as .zip, .top, .xyz and .tk.
  • Phishing vocabulary in the link: login, verify, password, wallet, refund, prize and similar.
  • No encryption (http instead of https).
  • Direct app downloads (.apk, .exe), which you should never install from a QR code.
  • Very long or heavily encoded links, and links that redirect to another website.
  • Payment requests (UPI, Bitcoin, Ethereum): we remind you to check the recipient.

How to read the verdict

Safe means we found none of these warning signs. It does not prove a website is legitimate, because a brand-new scam site on a normal-looking domain can pass every automated check. Caution means one or two things deserve a closer look. Risky means strong scam signals; don't open it, and if the code was in a public place, tell the business or the venue.

Habits that keep you safe

  1. Check whether a QR sticker has been placed over the original code. Run a finger over it.
  2. Be suspicious of codes that create urgency: "pay your fine within 24 hours", "your parcel is on hold".
  3. Never enter passwords or card details after scanning a code in a public place. Open the official app or type the address yourself.
  4. Pay for parking through the official app listed on the meter, not through a QR code on a sticker.
  5. Read our guide: How to spot a fake or dangerous QR code.

Frequently asked questions

Can a QR code hack my phone just by scanning it?

Scanning alone almost never harms a phone. The danger comes from what you do next: opening a phishing page, entering details, installing an app or approving a payment. This tool lets you see the destination first.

Does this scanner open the link?

No. It only decodes and analyzes. You decide whether to copy or open the link.

Is the link sent to a server for checking?

No. All checks run in your browser, so nobody learns which codes you scan. That also means we don't query live blocklists; use your browser's built-in protection as a second layer.

What does "Caution" mean for a shortened link?

Short links like bit.ly hide the real destination. Many are harmless, but scammers use them for the same reason. Only continue if you trust the source.

What should I do if I find a fake QR code?

Don't use it. Tell the business or venue owner, and report it to your local fraud reporting service (for example Action Fraud in the UK or the FTC in the US).

Can I check a link without a QR code?

Yes. Open "Or paste a link you want to check" and paste any link or text.

QR Code ScannerRead QR codes with your camera or from an image. Keeps a private scan history.QR Code Scannability CheckerUpload a QR code and get a score out of 100 with clear fixes before you print.QR Code GeneratorCreate QR codes for links, WiFi, vCards, WhatsApp and more, with logo, colors and frames.Google Review QR CodeA QR code that opens your Google review form, plus a printable review stand.Payment QR Code GeneratorUPI, PayPal.me and Bitcoin/Ethereum payment QR codes with optional amount.

Related guides

How to Spot a Fake or Dangerous QR Code5 min readHow to Make a UPI QR Code for Your Shop4 min readWhat Is a QR Code?5 min read

Last updated October 27, 2026 by the PloraKit team. Found a problem? Tell us.

Coming soon: Pro — dynamic QR codes Waitlist

Edit where a code points after you print it, and see scan analytics (time, city, device). Your free static codes here stay free and keep working forever — Pro is an optional extra.

We will send one email when Pro launches and nothing else. Contact: plorakit@gmail.com