How to check whether a QR code is safe
A QR code hides its destination until you scan it, which is exactly what phishing relies on. The scanner on this site decodes the payload first and then audits whatever it points at against live threat feeds — this guide shows how to run that check and how to read the verdict.
How to scan a suspicious code safely
The point of auditing first is that your camera app would open the destination directly, while the scanner shows it to you first. Open the Scan and Threat Check tab and hand it the code any of these ways: upload an image, drag one in, paste one with Ctrl and V, point your phone or laptop camera at it, or simply type a URL you are unsure about and press Scan URL.
Decoding happens in your browser. The audit itself is done by the threat checker: the decoded address is sent off for lookup, and the checker answers with a verdict and keeps no record of what you scanned.
Photograph the code instead of scanning it with your camera app. A photo you upload to the scanner never triggers the destination. A direct camera scan opens whatever is inside — which is the one action this whole check exists to precede.
What the audit checks
The scanner shows you the decoded destination first, then a verdict — SAFE, CAUTION, SUSPICIOUS or DANGEROUS — with every finding listed behind it. Concretely, it checks:
- Live blocklists: the address and its domains against the current URLhaus malware feed, plus phishing domain lists.
- DNS reputation: the domain through Cloudflare DNS security filtering, plus a public DNS lookup that catches addresses which do not resolve at all.
- The TLS certificate: whether it is valid, who issued it and when it expires.
- The redirect chain: up to four hops, listed one by one, so you can see every party the address passes through before you arrive.
- Dangerous schemes:
javascript:,data:,vbscript:andfile:payloads are treated as immediate threats. - Private and raw addresses: links to
localhostor an internal192.168.x.xrange, and bare IP addresses used to dodge a domain's reputation. - Typosquatting keywords: words such as
login,verify,banking,walletorpaypalappearing on a domain that is not the real brand's.
How to read the verdict
| Verdict | What it means | Next step |
|---|---|---|
| SAFE | Nothing matched a known bad source or a heuristic. | Reassuring, not a guarantee — brand-new scam pages match nothing yet. |
| CAUTION | Something minor looked off. | Read the findings before continuing. |
| SUSPICIOUS | A heuristic or reputation signal fired. | Do not enter credentials or payment details. |
| DANGEROUS | A real threat matched. | Stop. The Visit URL Safely button is withheld for this verdict. |
| Plain text payload | The code holds text, not an address. | Nothing to audit; the decoded text is shown for you to read. |
Read the verdict, not the badge. The Visit URL Safely button only appears when the check comes back anything other than DANGEROUS, and it points at the final destination after the redirect chain rather than the address printed in the image.
Limits worth knowing
- Blocklists lag new scams. A phishing page created ten minutes ago is on no list yet. Urgency, password requests and payment demands are judgement calls no feed can make for you.
- A shortened link hides the destination twice. The code hides the short link and the short link hides the target. Always expand the full four-hop chain in the findings before deciding.
- Physical placement is a signal too. A code stuck over another label, a light switch or a payment terminal deserves suspicion no scanner can confirm — no code should have been there in the first place.
- Text codes have nothing to audit. A code carrying instructions, a serial number or a note shows its decoded text with no URL checks, because there is no network target.
Frequently asked questions
How do I check a QR code without opening it first?
Open the Scan and Threat Check tab and give it the code: upload an image, drag one in, paste one with Ctrl and V, point your camera at it, or type the URL and press Scan URL.
Decoding happens in your browser, and only the decoded address is sent to the threat checker for the audit.
What does the scanner actually check?
Seven things: live malware and phishing blocklists, DNS reputation through Cloudflare security filtering, the TLS certificate, the redirect chain up to four hops, dangerous schemes like javascript and data URLs, private or raw IP addresses, and typosquatting keywords on a domain that is not the real brand.
What do the SAFE, CAUTION, SUSPICIOUS and DANGEROUS verdicts mean?
SAFE means nothing matched a known bad source or a heuristic, which is reassuring but not a guarantee. CAUTION and SUSPICIOUS mean something looked off and you should read the findings before continuing.
DANGEROUS means a real threat matched, and the Visit URL Safely button is withheld entirely.
Does the scanner keep a record of what I checked?
No. Scanning is the one step that sends the decoded address off your device, to the threat checker, which answers with a verdict and keeps no record of what you scanned.
Your images and payloads stay in the browser tab.
Can a SAFE verdict still be a scam?
Yes. A verdict of SAFE means nothing matched a known bad source or a heuristic, and a brand-new phishing page matches nothing yet.
Treat the verdict as one input: distrust urgency, password and payment requests, shortened links that land somewhere unexpected, and any code stuck over another label or a payment terminal.