Your phone's camera has trained you to trust QR codes: point, tap, done. That reflex is exactly what scammers exploit. A QR code hides its destination by design — unlike a link in an email, you cannot hover over it and read where it goes — so your phone simply opens whatever is encoded, and attackers exploit that blindness by pasting their own QR stickers over legitimate ones on parking meters, EV chargers, restaurant tables and parcel-delivery notices, or by mailing fake "package redelivery" codes. Our free QR safety scan is the pause button between scanning and tapping: upload or snap a QR code and see what it really hides, decoded on your device, never opened, with scam-pattern checks before you tap. This guide explains how to use it, the tricks scam codes reuse, and the ten-second check that defeats most of them.
Step one: add the code. Drop a screenshot or photo of the QR code onto the tool, click to browse, or snap it with your phone camera. Found a code on a parking meter, parcel slip or flyer? Check it here first — it takes seconds. Step two: read the hidden data as plain text. The tool extracts the raw text or URL inside the code and displays it as plain text. Nothing is clicked, previewed or opened — a malicious page can never load, which is the one thing that would actually put you at risk. Step three: review the risk flags. Heuristic checks look for quishing patterns — fake lookalike domains, IP addresses, hidden shorteners, non-HTTPS links — and you get a VirusTotal link for a deeper reputation check before you visit. Decoding runs entirely on your device: the image is never uploaded anywhere, and the QR decoder library is downloaded once from a CDN the first time you use the tool, which is the one moment that needs an internet connection. After that first download, your photos stay on your device throughout.
Scam QR codes overwhelmingly reuse the same tricks, which is why a checklist beats intuition. Lookalike domains are the classic: a domain that looks like a bank or delivery company but uses lookalike characters — paypaI with a capital i instead of a lowercase L, or Cyrillic letters that render identically to Latin ones — a trick called punycode or Unicode lookalike abuse. Raw IP addresses instead of domain names are another red flag: a legitimate bank or courier does not send you to a bare string of numbers. URL shorteners conceal the real site entirely, which is why a shortened link inside a QR code deserves suspicion on principle: you are being asked to trust two hidden destinations, not one. Then there are user@host redirect tricks, where the part before the @ sign is decoration and the real destination follows it; plain HTTP pages that harvest card details without encryption; high-abuse top-level domains; and URLs hidden inside descriptive text, where the visible words say one thing and the link goes somewhere else. The tool checks for all of these — punycode or Unicode lookalikes, IP-literal addresses, known shorteners, user@host tricks, non-HTTPS links, high-abuse domains, hidden URLs — and shows you the decoded text so you can apply your own judgement too. A few seconds of checking defeats most of these scams, because most of them depend on you not checking at all.
Take the most common real-world case: a QR sticker on a parking meter. The meter itself is legitimate, but someone has pasted their own code over the real one, and the fake code points to a payment page that harvests card details. Your phone's camera would open it without a second thought. The safe workflow takes ten seconds: photograph the code instead of scanning it with your camera app, drop the photo into the QR safety scan, and read the decoded URL as plain text. If it shows a lookalike domain, a bare IP address, a shortener hiding the destination, or plain HTTP where a payment page should be encrypted, you have your answer — walk away, pay at the meter itself, or use the official parking app you already have installed. If it shows no red flags, you still have not proven it safe — a brand-new phishing site can look perfectly normal to these checks — so treat any unexpected QR code as untrusted and use the VirusTotal link for a deeper reputation check before visiting. That last sentence is the most important one in this guide: "no red flags found" is not a certificate of safety. It only means none of the known scam patterns matched.
Scanning with your camera app out of habit. Your camera opens whatever is encoded, instantly, with no chance to inspect it — photograph the code and check it here first instead. Trusting a code because it is printed nicely. A sticker pasted over a real code looks just as professional as the original; placement proves nothing. Treating "no red flags" as "safe". The checks catch known patterns, not new phishing sites; an unexpected code stays untrusted until a reputation check backs it up. Ignoring a shortener inside a code. A shortened link hides the destination by design — inside a QR code, that is two layers of hiding, and it deserves suspicion on principle. Typing card details into an HTTP page. A payment page without HTTPS has no encryption; no legitimate payment flow works that way. Assuming a familiar brand name in the URL means a familiar brand. Lookalike characters and user@host tricks exist precisely to defeat a quick glance — read the decoded text character by character, or let the tool's lookalike check do it for you.
The honest limits are four. First, the checks are heuristic: they catch known scam patterns, and a brand-new phishing site can look perfectly normal to them, so "no red flags found" is never a guarantee — use the VirusTotal link for a deeper reputation check on anything unexpected. Second, the decoder library downloads once from a CDN the first time you use the tool, so that first use needs an internet connection; everything after that, including the decoding itself, is on your device. Third, the tool reads QR codes only — it cannot check a link you received as plain text, a barcode, or a code embedded in a video. Fourth, it deliberately never opens the link, which is what keeps you safe, but also means it cannot tell you what the page itself looks like — only what the code contains and which patterns it matches. Within those limits, the tool does one job completely: it turns an unreadable code into readable text and a set of risk flags, in seconds, without ever putting you at risk from the thing you are checking. The companion guides are our data broker removal guide, for shrinking what scammers can find about you in the first place, our strong password guide, for the account security that matters if a credential ever leaks, and our face blur guide, for keeping personal photos share-safe when a code or a post would otherwise expose more than you intended.
Shrink what scammers can find about you in the first place.
The account security that matters if a credential ever leaks.
Keep personal photos share-safe when a post would expose more than you intended.