Decode a QR code
A QR code hides its destination by design: you only find out where it leads once your phone is already there. Drop the image here and read the address first, in plain text.
Drop a QR code image here, or
Screenshot, photo, downloaded image: nothing leaves your device.Why is a QR code a blind click?
A link in an email can be inspected: you hover over it, you read the address. A QR code offers nothing of the sort. It is a picture, and the only way to know what it contains is normally to let the camera open it. That gap is exactly what quishing exploits: a sticker glued over the code on a parking meter, a fake code on a delivery notice, a printed invoice pointing to a payment page that is not the right one.
How does this tool work?
Your browser reads the image itself, using its built-in code reader. The picture is never uploaded, the address is never opened. Once the address is extracted, it goes straight through the same checks as the link analyser: real domain, brand used as decoration, letters borrowed from another alphabet, shorteners.
What it cannot tell you
It reads the address, not the page behind it. A QR code pointing to a perfectly ordinary domain can still lead to a scam, and a shortened link keeps its destination hidden until it is opened. The reflex stays the same: never enter bank details or a password on a page reached from a code you did not print yourself.
Frequently asked questions
Is my image sent to a server?
No. The image is read inside the page by your browser's built-in code reader. It is never uploaded, never stored, and the address found is never opened.
Which browsers can read a QR code?
Chrome, Edge, Safari and Android browsers provide the reader natively. Firefox does not offer it yet: rather than send your image to a third-party service, the tool says so plainly and does nothing.
What is quishing?
Phishing through a QR code. Since the code hides its destination, an attacker only has to stick their own code over a legitimate one, on a parking meter, a delivery notice or an invoice, to send you to a page that imitates the real service.
Does the tool check the address it finds?
Yes. When the code contains a web address, it goes through the same checks as the link analyser: real domain, brand used as decoration, letters from another alphabet, shorteners, risky extensions.
Can I trust a QR code printed on an official document?
Paper proves nothing: a sticker costs nothing to produce and to glue on. Read the address before opening it, and when it comes to payment, prefer typing the official address yourself.
Other tools
Don't miss the next analysis