QR Code Scanner
Read a QR code and see where it goes before anything follows it.
Scan a code
Decoded by your browser — nothing is uploadedThe contents are shown in full before you do anything with them. That is the point of scanning a code you did not make: a camera app hides the destination behind a tap, and a shortened link in a QR code on a car park sign is the standard shape of the scam.
How this processes your file
The browser's own barcode detector reads the code, from the camera or from an image you choose, and the contents are shown in full before anything else happens. That order is the whole point. A camera app decodes a code and offers to follow it in one motion, so the destination flashes past — which is exactly what makes a sticker placed over a genuine QR code on a parking meter or a restaurant table effective. Here the payload is classified first: a link, a Wi-Fi join, a contact card, a payment request. Shortened links, plain http links and links to bare IP addresses are called out, because those are the shapes worth pausing over.
What the results mean
- Shortened link
- The address shown is a redirect service, so it does not say where it goes. The standard shape of a QR-code scam, because the real destination is invisible.
- Payment request
- A code that asks you to send money to an address a human cannot verify by reading. Substituted payment codes are among the most effective scams there are, and the payment is irreversible.
- Wi-Fi credentials
- Scanning offers to join a network. Joining puts whoever runs it between you and anything not already encrypted — fine in a café, less fine on a lamppost.
- Plain http link
- Anything sent to that address travels unencrypted. Most sites redirect to https; one that does not is either very old or not what it appears to be.
Common problems and fixes
- The camera button does nothing
- Firefox has no barcode detector. Use a Chromium browser, or scan an image file — which uses the same detector and is also unavailable there.
- It will not read the code
- Fill more of the frame with the code, keep it flat and get more light on it. A photograph of a screen usually scans better than a screenshot of a photograph.
- The link is shortened and I want to know where it goes
- Expanding it means fetching it, which is the thing being avoided. Treat a shortened link on a physical sticker as unverifiable, because it is.
Frequently asked questions
Are QR codes dangerous?
The code is not; what people do with it is. The risk is that a camera app decodes and follows a link in one motion, so nobody reads the destination — which is why placing a sticker over a legitimate code on a parking meter or a restaurant table works so well. Reading the payload before acting on it removes almost the entire class of problem, and that is all this page does.
How can I tell if a QR code is a scam?
Check three things, all of which are shown above. Whether the link is shortened, since that hides the destination entirely. Whether the domain is the one you expect for the business whose sign it is on. And whether a physical sticker has been placed over something printed — the most common attack is not a fake code, it is a real one covered up.
Is my camera image uploaded?
No. Frames are analysed by the browser and discarded; nothing is recorded and there is no endpoint to send anything to.