QR Code Reader
See where a QR code goes before you follow it.
Loading the reader…
About the QR Code Reader converter
Drop in a photograph of a QR code, or point your camera at one, and see what it actually says — the full address, the domain that really owns it, and whether the way it is written is designed to mislead you.
Nothing is uploaded, and nothing behind the code is contacted. The link is not followed and shortened links are not expanded, so whoever printed the sticker never learns that anybody looked.
A QR code is the only link you follow blind
Every other link on earth shows you where it goes before you commit to it. You can hover over one, read the status bar, hold a finger on it. A QR code is a picture of an address, and a picture is the one thing a person cannot read — so the first time you find out where it goes is after you have gone there.
That gap is the entire problem, and it is why the attack built on it needs no software at all. Somebody prints a sticker and puts it over the real one: on the parking meter, the restaurant table, the electric charger, the parcel locker, the poster at the bus stop. Nothing is hacked. The code is perfectly genuine. It is simply not the one that was there yesterday.
The name before the @ sign
The oldest trick in the list and still in service. In a web address, everything between the scheme and the @ sign is a username, not a destination — so `https://apple.com@not-apple.tld/verify` goes to not-apple.tld, and reads to almost everybody as Apple.
Browsers stopped displaying that part years ago precisely because it fooled people, which helps right up until the address arrives as a picture instead of as text. This page pulls the authority apart and tells you the host that actually decides where you land.
Domains written in another alphabet
Domain names can be written in any script, which is right and necessary and also the basis of the neatest attack going. Cyrillic а, е, о, р, с and х are visually identical to Latin a, e, o, p, c and x in every font a browser uses. A domain spelled with one of each is a different domain from the one you think you are reading, and it is available to register.
Such a name travels through the network encoded, beginning `xn--`, and something has to decode it before a human sees anything meaningful. This page does, shows you the result, and says plainly when a single name mixes Latin letters with another script — because a domain that is part Latin and part Cyrillic is essentially never innocent, whereas one that is wholly Cyrillic is very likely just Russian.
The part of the address that actually matters
Only the label immediately before the top-level domain says who owns a site. Everything to the left of it is a subdomain, and anybody can put anything there — so `paypal.com.secure-login.ru` belongs to secure-login.ru, has always belonged to secure-login.ru, and contains the word paypal purely because you read left to right.
It is the commonest shape a phishing address takes, and it works on people who know better, because the brand is the first thing on the line and the domain is buried in the middle. The result here leads with the registrable domain and nothing else, because it is the only part that answers the question.
Why shortened links are not expanded
Because expanding one means asking the shortening service where it points, and that request tells them somebody looked, roughly from where, and when. A tool whose entire promise is that you can inspect a code without touching what is behind it cannot quietly make a network request on your behalf — that would be the one thing it exists not to do.
So a bit.ly or tinyurl link is reported as exactly that: a shortener, destination unknown, not checkable without contacting them. It is the honest answer rather than the convenient one, and on a sticker in the street an address that will not say where it goes is itself the finding.
There is no button to open the link
Deliberately. The point of stopping to look at a code is undone if the dangerous thing is then one keystroke away — and a page that shows you a warning next to a big blue Open button has produced a warning nobody reads.
The contents can be copied, so if you decide you do want it, you paste it somewhere you can look at it a second time. That small friction is the whole product.
What else a code can be
Not everything is a link. A code can join you to a WiFi network, in which case the page shows you the name, the security type and the password, and points out that whoever runs a network can see and redirect what you do on it. It can be a contact card, a calendar entry, a phone number or a text message — and a text to a premium number costs money and confirms your number is live.
It can also be a payment instruction, which is the one worth stopping over. Payment codes are precisely why stickers get placed over other stickers, and the only real defence is to check the name and amount your banking app shows against who you believe you are paying.
It reads damaged codes, and tells you they were damaged
QR codes carry Reed–Solomon error correction, which is why one still scans with a corner torn off or a coffee ring across it. This reader implements the correction properly rather than only handling clean input, because clean input is not what a photograph of a sticker on a lamp post looks like.
It then reports how much of that redundancy it had to spend. Normally that is simply a fact about your photograph. Occasionally it is a fact about the code — a sticker over a sticker does not lie perfectly flat.
Frequently asked questions
Does this open the link or visit the website?
No, and it will not. The address is taken apart and examined as text. Nothing behind the code is contacted at any point, which is the difference between this and scanning it with your phone to see what happens.
Can it tell me where a bit.ly link really goes?
No, and that is on purpose. Finding out means asking the shortening service, which tells them somebody looked. It reports that the link is shortened and that its destination is unknown — which, on a code you did not expect, is a useful answer in itself.
Is my photograph uploaded?
No. The image is read inside the page on your own machine. You can check by disconnecting from the network and scanning again — it works exactly the same, because decoding a QR code is arithmetic and needs nobody else.
What is quishing?
Phishing delivered by QR code. It works because a code cannot be read by eye, so the usual advice to check a link before clicking it has nothing to act on — and because a printed sticker bypasses every email filter between the attacker and you.
How do I know a code in the street has not been replaced?
Mostly by touch: a sticker over a sticker has an edge you can feel and often a slight lift at one corner. Beyond that, judge the destination rather than the code. A parking meter that sends you to a domain you have never heard of is worth walking away from whatever the sign says.
Can it read a code from a screenshot?
Yes. Paste it straight into the page, or drop the file in. That is the common case for codes arriving by email or message, which is exactly where you would want to look before following one.
Does it work on damaged or angled photographs?
Usually. It corrects perspective from the three corner squares and the alignment pattern, tries several exposures, handles codes printed light on dark, and applies the format’s own error correction. A code with all three corner squares visible and about three pixels per square generally reads.
It says nothing is wrong. Is the site safe?
It means the address is not written to deceive you — no lookalike domain, no name planted before an @ sign, no mixed alphabets. Whether the page at the far end is trustworthy is a different question, and not one any amount of reading the address can answer.