How to Check if a QR Code Is Safe Before You Scan It

To check if a QR code is safe, read what it contains before your phone acts on it. Upload a photo or screenshot of the code to our free QR code reader and you get the raw text: the full link, or the Wi-Fi network, text message or contact it would trigger. Then check three things: the real domain at the end of the host name, where any short link actually redirects, and whether the code looks like it was stuck over another one. The reader is free, needs no account and decodes the image in your browser, so nothing is opened or uploaded.

The examples below come from tests we ran on the live tools on November 1, 2026, using QR codes we made for this article. The lookalike addresses use the reserved .example domain, so they can't lead anywhere.

How to check a QR code before you scan it, step by step

1. Get an image of the code. Take a photo with your camera app (a photo doesn't open anything) or a screenshot if the code is in an email, PDF or text message.
2. Decode it without opening it. Upload the image to the QR code reader. It shows the exact text stored in the code, nothing more.
3. Identify what kind of code it is. A link starts with https:// or http://. Codes can also start with WIFI:, SMSTO:, tel:, mailto: or BEGIN:VCARD, and each one makes your phone do something different.
4. Find the real domain. Paste the link into the URL parser and read the Host row from right to left. The part just before the ending (.com, .org, .gov) is who you're really dealing with.
5. Expand short links. If the link uses a shortener or a QR service domain, run it through the URL redirect checker to see every hop and the final page.
6. Check the physical code. Look for a sticker on top of a printed code, edges that don't line up, or two codes close together.
7. Decide how to proceed. If anything is off, don't open it. For payments and logins, type the company's address yourself or use its official app.

Try it now: screenshot any QR code on your screen and drop it into the free QR code reader. You'll see the full contents in a second, and your phone never opens the link.

What our QR code reader showed for five real test codes

Example 1: a lookalike payment link

We encoded https://www.paypal.com.account-verify.example/signin?session=8841, the kind of address a fake "your payment failed" email might use. The reader returned the full link, and the URL parser split it like this:

The host starts with www.paypal.com, but that's only a label on the left. Read it from the right and the real domain is account-verify.example. Whoever controls that domain can create any label in front of it, including a brand name. A phone preview that shows only the first 30 characters would display www.paypal.com.account-verif..., which is exactly why you want to see the whole host.

Example 2: a short link with three hops

Short links hide the destination, so a QR code that contains one tells you nothing until you expand it. We ran the short link https://amzn.to/3QOBRdb through the URL redirect checker:

The chain ends on www.amazon.com with a 200, so you know where it goes before you open it. The status codes are explained in our guide to checking 301 and 302 redirects.

A limitation you should know about: our redirect checker currently follows only 301 and 302 hops. When we tested https://youtu.be/dQw4w9WgXcQ, it showed a single row with status 303 and no destination. If the last row isn't a 200, the chain isn't finished. Paste the same link into the HTTP headers lookup: it showed HTTP/2 303 and a location row with https://www.youtube.com/watch?v=dQw4w9WgXcQ&feature=youtu.be. Some sites also redirect with a relative address (just a path, no domain), and the checker then reports that it couldn't retrieve details. The headers lookup works there too.

Example 3: a Wi-Fi code

The reader returned WIFI:T:WPA;S:Cafe Guest;P:espresso2026;;. That's not a link. It tells your phone to join a WPA network called Cafe Guest with the password espresso2026. Check that the network name matches the one the venue actually uses. A code on a table can just as easily offer a network someone else controls, and everything you do on it passes through their equipment.

Example 4: a text message code

SMSTO:+15555550123:JOIN opens your messaging app with a text to +1 555-555-0123 that says JOIN. Sending it confirms your number to whoever owns that line and may sign you up for messages. If you didn't expect to text anyone, close the draft.

Example 5: two codes in one picture

Fake codes are often printed as stickers and stuck over the real one, or next to it. We put two codes side by side in one image: a parking payment link and our lookalike link from Example 1. The reader said No QR code found in this image. The message also lists tips for a better photo. It looks for one code per image, so it gave up. When we cropped each half and uploaded them separately, it read https://parking.example-city.gov/pay?zone=214 and the lookalike PayPal link. Two codes that point to different domains on one sign is a strong sign that one of them was added later.

How reliable is the reader on real-world photos?

We also checked how forgiving it is. Every one of these decoded correctly:

We watched the browser's network activity while it decoded. The image was never sent anywhere, which matters if the code is on a ticket or a document with personal details.

Red flags once you can see what's inside

• A brand name that isn't the real domain. paypal.com.account-verify.example belongs to account-verify.example. Also look for swapped letters such as paypa1 or rnicrosoft.
• A short link on something official. A parking meter or invoice that hides its address behind a shortener deserves an expansion before you pay.
• A login or payment page you didn't plan to visit. The FBI's January 2022 public service announcement on tampered QR codes advises against paying through a site reached from a QR code. Type a known address instead.
• A direct app download. The same FBI notice says to install apps from your phone's app store, not from a QR code, and not to download a separate QR scanner app, because most phones already scan with the camera.
• Urgency. The FTC's December 2023 consumer alert lists the usual stories: a package that couldn't be delivered, a problem with your account, suspicious activity that requires a password change.

Pitfalls that catch careful people

• Trusting today's check forever. Many QR services print a short link on their own domain instead of your destination. The owner can change where it points at any time. When we opened https://qrco.de/, a domain used by one of the big QR generators, it redirected to that company's help center. A code that was fine last week can point somewhere else today.
• Assuming everyone lands on the same page. We followed the Microsoft short link https://aka.ms/terminal from two places. From Argentina, the second hop went to a /es-ar/ page. From our server, it went to /en-us/. Redirects can depend on country, language or device, so a clean result proves where the link went for the checker, not for every visitor.
• Checking the domain but not its age. A real-looking domain registered last week is a warning sign. Run it through the Whois lookup and the SSL lookup. Our guide on how to check if a website is legit walks through the full routine.

If you already opened a bad QR code

The FTC's September 2026 alert about parking QR codes gives three steps: stop interacting with the site, immediately change any password you entered (everywhere you reused it), and review your card and bank statements. Report it at ReportFraud.ftc.gov in the US, or to the FBI at ic3.gov if money was stolen. If you reused that password, our guide to creating a strong password and the password generator help you replace it quickly.

Running a business that prints QR codes? Make your own with the QR code generator, point it straight at your real domain instead of a third-party short link, and check your signs regularly for stickers.

Frequently asked questions

Can you tell if a QR code is safe without scanning it?

Yes. Take a photo or screenshot and upload it to a QR code reader that only decodes the image. You'll see the full link or command without your phone opening it, then check the domain and any redirects.

Can scanning a QR code hack your phone?

Reading the code only gives your phone some text. The risk comes from what you do next: opening a fake login page, entering payment details, installing an app, joining a Wi-Fi network or sending a text. Keep your phone's software updated too, as the FTC recommends.

How do I see where a QR code link goes?

Decode it with the QR code reader, then paste the link into the URL redirect checker. If the last row isn't a 200 (for example a 303), use the HTTP headers lookup and read the location row.

Why does the QR code reader say No QR code found?

The image may contain two codes, which the reader can't handle in one image, or the code may be cut off or very blurry. Crop to a single code and try again. In our tests, rotated, blurred, tiny and borderless codes all decoded. Pale and inverted codes are handled too: since November 1, 2026 the reader automatically retries with contrast-boosted and inverted copies of the image.

Is a QR code with a short link always a scam?

No. Many legitimate businesses use shorteners or QR services for tracking. It just means you can't judge the destination until you expand the link, and the owner can change it later.

Is the QR code reader free?

Yes. It's free, needs no account and decodes the image in your browser without uploading it. Visitors get 5 tool uses a day, and a free My Botsy account (100% free, no spam) removes that cap.

Got a code you're not sure about? Open the free QR code reader, upload a photo or screenshot, and read exactly what it would do before your phone does it.