How to read a QR code safely before opening its link
Decode a QR code before following it, check the actual hostname and recognise the limits of link warnings, shortened URLs and payment prompts.
By ToolsNow · Published · updated
Read the decoded address before opening a QR link, especially on a payment notice or a sticker in a public place. A familiar logo beside the code does not authenticate its destination.
The QR reader shows the decoded content first. It does not automatically open links, join Wi-Fi networks or save contact cards.
Decode the code without following it
- Choose or paste a photo containing the code, or choose Scan with camera and grant camera access if you want to use it.
- Read Decoded content. For a web address, check the separate Host field as well as the full URL.
- Compare the destination with the organisation you expected. For a sensitive task, use its known website or official app if you are unsure.
- Choose Open this link only when you intend to visit it. The reader makes HTTP and HTTPS links clickable; other payloads are shown as text or fields.
If scanning fails, try a sharper, square-on photo with the whole code and its surrounding blank border visible. Crop away unrelated parts of a large photo. The reader reduces large images before decoding, so a tiny code in a wide scene can lose detail.
Check the hostname, not just a familiar word
Consider this address without opening it:
https://yourbank.com.secure-login.info/accountThe full hostname is yourbank.com.secure-login.info. In this example,
the registered domain is secure-login.info; yourbank.com is only a
subdomain prefix. Seeing the bank’s name at the start does not make the
address belong to the bank.
Another misleading form is https://[email protected]/. The part
before @ is user information, and the host is evil.example. Use the
reader’s parsed Host field rather than trying to split a complicated URL
by eye.
HTTPS encrypts the connection to the named host. It does not prove that the host is the company you intended to visit. Check the full address too: paths and query strings can contain redirects or other important details.
What the warnings mean
The reader flags features worth inspecting, including:
- Punycode names containing
xn--. These can represent legitimate internationalised domains or names using lookalike characters. The prefix alone is not evidence of a scam. - Raw IP addresses, such as
https://192.0.2.14/login. These can be legitimate, particularly for local devices, but need an explanation in a public payment link. - Embedded usernames or passwords, as in the
@example above. - Unusual ports, plain HTTP or very long addresses. Each needs context; none is a verdict by itself.
The reader does not visit the destination, expand redirects or check a
reputation service. An address with no warning is not a safety certificate.
Schemes such as javascript:, data: and file: are not made clickable
here; do not paste an unexpected one into another program to bypass that.
Short links and replacement stickers
A shortened address such as bit.ly/xyz does not reveal its eventual
destination. Redirects can also change over time. Rather than following an
unexpected short link to investigate, use a known contact method or type
the organisation’s address yourself.
Look at the physical code too. A sticker placed over another code or an unexpected payment instruction is a reason to check with the operator. The FTC documents scams involving replacement QR codes on parking meters and unexpected messages about deliveries or account problems.
For a payment, check the recipient and amount in the payment app before authorising it. Decoding the QR successfully only tells you it was readable.
A QR code may contain something other than a web link
Common codes carry text with prefixes that scanning apps interpret:
| Example payload | What a compatible app may offer |
|---|---|
https://example.com | Open a website |
mailto:[email protected]?subject=Hi | Compose an email |
tel:+441234567890 | Dial a number |
SMSTO:+44123:message | Compose a text message |
WIFI:T:WPA;S:MyNet;P:secret;; | Join a network |
BEGIN:VCARD… | Save a contact |
geo:51.5,-0.12 | Open a map location |
ToolsNow previews these values without carrying out those actions. A Wi-Fi code may include its password in readable form, so avoid sharing a copy more widely than you would share that password. A contact card or a QR pattern can contain a claim about identity; the claim still needs checking.
Camera and file handling
The reader decodes saved images and camera frames in the browser. Its camera control stops the stream after finding a code, when you press Stop camera, or when the component closes. If camera access fails, use the file picker. Opening a decoded link is a separate network action and takes you to the destination site.
Sources and further reading
- ISO/IEC 18004 — QR Code symbology specification
- RFC 5891 — Internationalized Domain Names in Applications
- Unicode Technical Report #36 — security considerations, including confusable characters
- US FTC — scammers hiding harmful links in QR codes
- OWASP — Unvalidated Redirects and Forwards Cheat Sheet
Last reviewed 2 October 2026.
Published by ToolsNow. Read how tools and sources are checked.
Found a mistake or an outdated detail? Send a correction with the article title and the detail to review.