How to read a QR code safely before opening its link

Two QR codes can look equally trustworthy and lead to completely different places. There is no visual difference between one that opens a restaurant menu and one that opens a convincing copy of your bank’s login page — the pattern is just an encoding of text, and none of it is readable by eye.

That gap between what you can see and what you are about to do is the whole basis of QR-based scams, and closing it takes about ten seconds.

What is actually inside a QR code

A QR code stores text. That is the entire mechanism. What makes it do something is a convention about how that text begins:

Content	What it does when scanned
https://example.com	Opens a web page
mailto:[email protected]?subject=Hi	Starts an email
tel:+441234567890	Offers to dial
SMSTO:+44123:message	Composes a text
WIFI:T:WPA;S:MyNet;P:secret;;	Offers to join a network
BEGIN:VCARD…	Offers to save a contact
geo:51.5,-0.12	Opens a map
Anything else	Displays as plain text

Camera apps mostly hide this and show a friendly prompt, which is convenient and is also precisely where the information you need gets lost.

Why the pattern tells you nothing

The visual pattern encodes the characters, plus error-correction data that lets a damaged code still scan. Two codes differing by a single character in the URL look entirely different; two codes leading to opposite ends of the internet look equally ordinary. There is no checksum of trustworthiness, no issuer, no signature.

This is what “quishing” exploits: printing a sticker with a malicious code and placing it over a genuine one. Parking meters, restaurant tables, EV chargers and parcel lockers have all been targeted, because in each case people expect to scan a code in a public place and expect it to lead somewhere transactional.

Physical inspection is worth a moment on any code in a public place. A sticker over a printed code, a code that looks newer than its surroundings, or one slightly misaligned with the design around it are all worth a second look.

Reading the destination first

A reader that shows you the decoded content before acting is doing the one thing your camera app does not. Paste in a photo or screenshot — or use the camera, but with a tool that decodes rather than navigates — and read the address.

What to look at, in order:

The scheme. https is ordinary. http means unencrypted. Anything else — javascript:, data:, file: — has no business in a QR code you were handed and should never be followed. The reader here will not make those clickable at all.

The host. This is the part that matters, and it is the part people misread. The domain is what comes immediately before the first single slash. In https://yourbank.com.secure-login.info/account the actual host is secure-login.info — yourbank.com is just a subdomain label designed to be the first thing you read.

Then the rest. Path and query strings are far less important than the host, and long ones are frequently there to push the real domain out of view.

The specific things worth flagging

Punycode. Internationalised domains are encoded with an xn-- prefix. The legitimate use is non-Latin domain names. The abuse is homograph attacks: Cyrillic а and Latin a are visually identical in most fonts, so a domain built from lookalike characters can imitate a familiar brand exactly. Seeing xn-- does not mean malicious — it means the name you read may not be the name that resolves.

Bare IP addresses. https://192.0.2.14/login skips domain names entirely. Legitimate uses exist on local networks; on a public sticker it is a strong signal.

Embedded credentials. https://[email protected]/ looks like it goes to your bank. Everything before the @ is a username, and the real host is evil.example. Browsers have restricted this over the years, but it still appears.

Non-standard ports and very long URLs. Neither is proof of anything, and both are common in obfuscation.

What a reader cannot tell you

No QR reader can determine whether a destination is safe. It can show you the address and point out characteristics worth attention — which is exactly what the tool here does, and where it stops.

Checking a URL against a reputation database would mean sending your scanned link to a third party, which trades one privacy problem for another. The reader here deliberately does not do that, and says so.

A shortened link is the clearest case of the limit: bit.ly/xyz reveals nothing about its destination, and the only way to know is to follow it. When a code you did not expect resolves to a shortener, that combination is worth declining.

Wi-Fi, contacts and payments

Wi-Fi codes contain the network name, security type and password in plain text. Reading one before joining tells you whether the network is open — and an open network means traffic is not encrypted by the network itself. Joining any network lets its operator observe traffic metadata.

Contact cards are harmless to preview and should never be saved automatically; the tool here displays the fields without touching your address book.

Payment codes deserve the most care of all, because the whole point is to move money. Verify the recipient shown by your payment app against who you expect, and be wary of any code presented as a payment request in an unexpected context — a “parking fine” notice or an emailed invoice, particularly.

Camera privacy

Scanning with a camera means granting camera access. A tool that decodes in the browser reads frames into a canvas on your device and never transmits them; the reader here stops the camera the moment a code is found, and releases the stream when you leave the page.

If you would rather not grant camera access at all, photographing the code with your normal camera app and then uploading that image achieves the same thing — and gives you a copy you can inspect at leisure.