How to check a QR code before opening its link

Preview a QR code’s contents, inspect the destination domain and understand what a QR reader can and cannot tell you about a link.

By ToolsNow · Published 31 July 2026

A QR code can hold a link, plain text, contact details or other data. The pattern alone does not tell you whether the destination is the one you expect.

Use the QR code reader to inspect its contents before opening a link. Check the domain and context; a readable address or an HTTPS connection does not establish that a website is trustworthy.

What’s actually inside a QR code

A QR code stores text. That’s the whole mechanism. What makes it do something is a convention about how the text begins:

Content	What it does when scanned
`https://example.com`	Opens a web page
`mailto:[email protected]?subject=Hi`	Starts an email
`tel:+441234567890`	Offers to dial
`SMSTO:+44123:message`	Composes a text
`WIFI:T:WPA;S:MyNet;P:secret;;`	Offers to join a network
`BEGIN:VCARD…`	Offers to save a contact
`geo:51.5,-0.12`	Opens a map
Anything else	Displays as plain text

Camera apps mostly hide all of this behind a friendly prompt. Convenient, and exactly where the information you need disappears.

Why the pattern tells you nothing

The visual pattern encodes the characters plus error-correction data, which is what lets a damaged code still scan. Two codes differing by a single character in the URL look entirely different. Two codes leading to opposite ends of the internet look equally ordinary. There’s no checksum of trustworthiness, no issuer, no signature.

This is what “quishing” exploits: print a sticker with a malicious code, stick it over a genuine one. Parking meters, restaurant tables, EV chargers and parcel lockers have all been hit, because in each case people already expect to scan a code in a public place and expect it to lead somewhere transactional.

Physical inspection is worth a moment on any code out in public. A sticker over a printed code, a code that looks newer than everything around it, one slightly misaligned with the design it sits in: all reasons to look twice.

Reading the destination first

A reader that shows you the decoded content before acting on it does the one thing your camera app doesn’t. Paste in a photo or a screenshot, or use the camera with a tool that decodes instead of navigating, then read the address.

What to look at, in order.

The scheme. https is ordinary. http means unencrypted. Anything else, javascript:, data:, file:, has no business in a QR code somebody handed you and should never be followed. The reader here won’t make those clickable at all.

The host. This is the part that matters, and the part people misread. The domain is whatever comes immediately before the first single slash. In https://yourbank.com.secure-login.info/account the actual host is secure-login.info. The yourbank.com is a subdomain label put there to be the first thing you read.

Then everything else. Path and query strings matter far less than the host, and long ones are frequently there to push the real domain out of view.

The specific things worth flagging

Punycode. Internationalised domains get encoded with an xn-- prefix. The legitimate use is non-Latin domain names. The abuse is homograph attacks: Cyrillic а and Latin a are visually identical in most fonts, so a domain built from lookalike characters can imitate a familiar brand exactly. Seeing xn-- doesn’t mean malicious. It means the name you’re reading may not be the name that resolves.

Bare IP addresses. https://192.0.2.14/login skips domain names altogether. There are legitimate uses on local networks. On a public sticker it’s a strong signal.

Embedded credentials. https://[email protected]/ looks like it goes to your bank. Everything before the @ is a username, and the real host is evil.example. Browsers have restricted this over the years, but it still turns up.

Non-standard ports and very long URLs. Neither proves anything, and both are common in obfuscation.

What a reader can’t tell you

No QR reader can determine whether a destination is safe. It can show you the address and point out characteristics that deserve attention, which is what the tool here does, and where it stops.

Checking a URL against a reputation database would mean sending your scanned link to a third party, trading one privacy problem for another. The reader here doesn’t do that, by design, and says so.

Shortened links are the clearest case of the limit. bit.ly/xyz reveals nothing about where it goes, and the only way to find out is to follow it. When a code you weren’t expecting resolves to a shortener, that combination is worth declining.

Wi-Fi, contacts and payments

Wi-Fi codes contain the network name, security type and password in plain text. Reading one before you join tells you whether the network is open, and an open network means the network itself isn’t encrypting your traffic. Joining any network at all lets its operator observe traffic metadata.

Contact cards are harmless to preview and should never be saved automatically. The tool here displays the fields without touching your address book.

Payment codes deserve the most care, because moving money is the entire point of them. Check the recipient your payment app shows against who you expect it to be, and be wary of any code presented as a payment request in an unexpected context. A “parking fine” notice or an emailed invoice, particularly.

Camera privacy

Scanning with a camera means granting camera access. A tool that decodes in the browser reads frames into a canvas on your device and never transmits them. The reader here stops the camera the instant it finds a code, and releases the stream when you leave the page.

If you’d rather not grant camera access at all, photograph the code with your normal camera app and upload that image instead. Same result, and you get a copy you can inspect at leisure.

Sources and further reading

Last reviewed 31 July 2026.