QR Code Checker: See the Link Before You Open It

Check a QR code before you open it. The checker reads the code from a photo, a screenshot or your camera, shows the full link with the real domain marked, and points out what is unusual, such as a link shortener or lookalike letters. The link is never opened, and nothing is uploaded.

QR code

Report

Choose an image, use the camera or paste the text: the report shows what the code holds and what is unusual about its link. Nothing is opened.

The checks only describe the code and its link. They cannot tell whether the site behind it is honest: if you did not expect the code, or it was stuck over another one, do not open it.

Duplicate-serial check

Paste the codes printed on a batch of labels, one per line, or choose a CSV, TXT or Excel file. The list is checked in your browser for codes that appear more than once and for GS1 numbers with a wrong check digit.

The result appears here: the duplicates with their line numbers, then the check digit errors.

How to Check a QR Code Before You Open It

Read the code here instead of with your camera app, then look at the marked domain and the flags before you decide to open the link.

  1. Take a photo or a screenshot of the QR code and choose it above, or press Use the camera.
  2. Read the Website line: the marked part is the site the link opens, whatever comes before it.
  3. Read each flag, such as a link shortener, an IP address or letters that only look Latin.
  4. Open the link only if the site is the one you expected; type a known address yourself if in doubt.

What the Checker Looks For

The checker reads the content of the code and lists what is unusual about it, in plain facts; it does not visit the link or ask any other service.

Signs in a Link

  • http instead of https: the page travels unencrypted.
  • An IP address: a number such as 192.168.1.10 instead of a name, also when it is written as one long number.
  • International or mixed letters: a name in Punycode (xn--), letters from two scripts in one name, or letters that only look Latin, such as Cyrillic а in аррӏе.com.
  • A familiar name before the real domain: paypal.com.account-verify.example.xyz is a site at example.xyz.
  • Text before @: in https://www.bank.com@example.net, the site is example.net.
  • A link shortener: such as bit.ly or tinyurl.com, which hides the destination.
  • An unusual port or a very long query: a number after the name, such as :8443, or more than 200 characters after the ?.
  • Not a web address: javascript:, data:, intent: and other schemes that run code or open an app.

Wi-Fi Codes

  • Security: the network's security type: WPA, WEP or none.
  • Open networks: a network without a password, which anyone nearby can join.
  • WEP: the oldest Wi-Fi security, flagged because current routers use WPA2 or WPA3.

Other Contents

Phone numbers, text messages, emails, contact cards, calendar events and map locations are shown with what opening them does, such as starting a call after you confirm. Plain text is shown as text.

Is This QR Code Safe?

No checker can promise that a QR code is safe: it can show where the code leads and what is unusual about it, but not whether the site or the sender is honest.

Where the Code Is Matters

A code printed on a sticker over another code, on a parking meter, a poster or a table, can send you to a different site. Look at the code itself before you scan it, and stop if it was stuck on top.

What a Report Without Flags Means

It means none of the checks on this page matched the link. A site with an ordinary https address can still ask for your password or card number, so type the address of a bank or a shop yourself instead.

Reading the Website Line

The marked part of the Website line is the registrable domain: the name its owner registered, which decides the site you reach.

Links and the site each one opens
Link in the CodeSite It Opens
https://paypal.com.account-verify.example.xyz/loginexample.xyz
https://www.bank.com@example.net/example.net
https://www.bbc.co.uk/newsbbc.co.uk
https://someone.github.io/pagesomeone.github.io

The domain is found with the Public Suffix List, which includes names such as co.uk and github.io under which other people register their sites.

QR code reader reads a QR code from an image and offers to open its link once you have checked it.

Duplicate Serial Numbers in QR Codes and Barcodes

A serial number that appears twice in a batch of labels can mean a copied label or a printing mistake: the duplicate-serial check finds them in a list in your browser.

  • Duplicates: every code that appears more than once, with its line numbers.
  • Check digits: GS1 numbers of 8, 12, 13, 14, 17 or 18 digits, and the GTIN in a GS1 Digital Link, checked with the GS1 check digit.
  • Files: a pasted list, or a column of a CSV, TXT or Excel file, up to 100,000 rows; the report downloads as CSV.

Check digit calculator shows how the check digit of a GS1 number is worked out, step by step.

Frequently Asked Questions

Does Checking a QR Code Open the Link?

No. The checker reads the code in your browser and shows the link as text: it never opens, loads or previews it. Copy the link if you want to open it yourself.

Can a QR Code Checker Tell If a Link Is Safe?

No. It can show the real domain and what is unusual about the link, but not whether the people behind the site are honest. Decide from the domain and the flags, and type a known address yourself when in doubt.

Can I Check a QR Code From a Screenshot?

Yes. Choose the screenshot, drop it on the box or paste it with Ctrl+V; the code is read on your device and the image is not uploaded.

Is the QR Code Checker Free?

Yes. It needs no account and no app, and both the QR code check and the list check run in your browser.

What Does a Link Shortener in a QR Code Mean?

The link goes to a short address, such as bit.ly, that forwards you to another one. The destination is hidden until the link is opened, so the checker cannot show it without visiting the link, which it never does.

Why Does the Checker Show Two Versions of a Website Name?

A name with international letters is sent as Punycode, starting with xn--, and shown in its letters. Seeing both makes a name that only looks familiar, such as аррӏе.com in Cyrillic letters, easier to spot.

Related QR Code Tools