QR code inspector

A QR code hides the address inside a pattern you cannot read. Scammers know this: they stick fake codes over real ones on parking meters, posters and restaurant tables, or email them in "delivery" and "security" messages. This tool reads a QR code and shows you what is really inside, and what looks suspicious about it, before you go anywhere.

Nothing is sent and nothing is opened. Pictures and camera images are read by and processed locally in your own browser, and never leave your device. This page also tells your browser to block every network request. The tool never opens a link for you: you have to choose to, and it warns you first.

Choose a photo or screenshot of the QR code, or scan it with your camera.
Read what is inside, and what the tool spotted.
Decide. If it is a bank, delivery or account link you did not ask for, type the official address yourself instead.

Drop a picture of a QR code anywhere in this box

A photo or screenshot that shows the code. JPEG, PNG or WebP.

Want to see it work first? Try a made-up code:

What to look for before you scan or open a QR code

Is it a sticker? Fake codes are often stuck on top of real ones on parking meters, charging stations, posters and menus. Run a finger over the edge. If the code peels, do not use it.
Did you ask for it? A code in an unexpected email, text or letter about a delivery, a fine, a prize or a "security problem" is a warning sign in itself.
Read the site name at the end of the address. The real site is the last part before the first single slash. paypal.com.secure-login.example belongs to secure-login.example, not to PayPal.
Be suspicious of anything urgent or anything asking for a login, a card or a code. Type the official address yourself, or open the official app, instead of following the code.
Payment and cryptocurrency codes cannot be undone. Check who you are paying and how much before you approve.
Wi-Fi codes connect you at once. Only join networks you trust.

What this can and cannot do

It cannot say a link is safe. "Nothing unusual spotted" only means none of these known tricks showed up. A brand-new scam site can look perfectly ordinary, so use your own judgement and the steps above.
It cannot follow short links or redirects. Doing so would mean contacting the site, which this page never does. Short links and QR-service links are flagged because the real destination is hidden and can be changed later.
It reads one code at a time, and it needs the whole code in the picture with a clear white border. Blurry, cropped, damaged or very small codes may not be found.
It cannot see how a physical code was placed, or whether a sticker covers another one. That is your check to make.
The "risk" flags are guidance, based on common tricks. They can miss things and can flag honest sites, especially for brand names and unusual endings.
To scan with the camera your browser will ask permission. The picture stays on your device, and the camera switches off as soon as a code is found or you press stop.

Built with jsQR (Apache-2.0) to read codes and qrcode-generator (MIT) to draw the samples, both served from this site. QR Code is a registered trademark of DENSO WAVE INCORPORATED.