Drop a photo / screenshot of the QR code here
Select image
or drop it here — decoded and judged 100% on your device
QR code image
Safety report
The QR was decoded on your device — the image never left your browser, so there is nothing to delete.
Why QR codes are the perfect phishing trick
QR code fraud starts with a simple fact: a QR code hides its destination. Unlike a link in an email — where you can hover and inspect the URL — a printed QR code is a black-and-white maze that your eyes can't read. Scammers know this: they print their own QR stickers and paste them over legitimate ones on parking meters, restaurant tables, package slips and event posters. You scan, you land on a pixel-perfect fake payment or login page, and your card details go straight to the scammer running the QR code scam. Security researchers call it quishing (QR phishing), and the FBI and FTC have both issued public warnings about it.
This checker decodes the QR on your device and runs the destination through a set of offline risk checks — typosquat and lookalike domains, punycode (non-Latin) tricks, URL shorteners, IP-address URLs, and plain HTTP — then shows you a plain-English verdict before anything opens.
Honest scope, stated upfront: static analysis is a heuristic, not a guarantee. A brand-new phishing domain can pass every check below. A clean report means "no red flags found" — not "proven safe." When money or logins are involved, type the official address yourself instead of scanning.
What the checker looks at
| Check | What it catches |
|---|---|
| Typosquat / lookalike domains | paypa1.com, micorsoft-login.com — near-misses of real brands |
| Punycode (IDN) tricks | Domains using non-Latin characters that visually mimic Latin letters |
| URL shorteners | bit.ly, tinyurl and friends — the destination is hidden behind the short link |
| IP-literal URLs | http://192.0.2.44/login — legitimate sites almost never do this |
| HTTP vs HTTPS | Non-encrypted pages asking for anything sensitive |
| Suspicious TLDs & long subdomains | Cheap throwaway domains and deceptive subdomain padding |
How to use this checker
- Step 1. Photograph or screenshot the QR code — a clear, straight-on shot works best.
- Step 2. Drop the image on this page and click Decode & check safety.
- Step 3. Read the decoded destination URL and the findings list — that's your answer to “is this QR code safe?”
- Step 4. If anything looks off — or money is involved — don't open it; navigate to the official site yourself.
Real-world use cases
- Parking meter QR stickers — the #1 reported quishing setup. Check the code before paying.
- Restaurant table codes — a sticker over the real menu code can lead to a fake payment page.
- Package delivery slips — "reschedule delivery" QRs that harvest personal details.
- QR codes in emails — phishing emails now embed QRs specifically to dodge link scanners.
Tips
- Check the physical code too. A sticker layered over the original print is the classic tamper sign.
- Beware urgency. "Scan now or lose access" is a scam marker — legitimate businesses don't manufacture urgency.
- Shorteners deserve suspicion. A business QR has no reason to hide behind bit.ly — ask why it does.
- Never enter card details from a scan. For payments, open the official app or site yourself.
- A clean report isn't a clean bill of health. New phishing domains pass static checks. Caution is the actual protection.
Frequently asked questions
Is QR Phishing Checker free to use without signup?
Yes. EzySize’s QR Phishing Checker tool is free to use without creating an account. Advertising may appear on this page; the tool remains free to use. Use the controls above and check the result against your requirements.
How can I check if a QR code is safe before scanning?
Photograph it and run it through this checker: the QR is decoded on your device and the destination URL is analyzed for phishing signals — typosquat domains, punycode tricks, URL shorteners, IP-address URLs and plain HTTP — before you ever open anything.
What is quishing?
Quishing (QR phishing) is phishing via QR codes: scammers print malicious codes — often pasted over legitimate ones on parking meters, tables or posters — that lead to fake login or payment pages. The FBI and FTC have both warned about it because a QR hides its destination until you've already arrived.
Can a QR code give my phone a virus?
The QR itself is just data — it can't contain a virus. The danger is the destination: a malicious site can try to steal credentials or trick you into installing malware. That's why checking where it goes first is the protection.
Does this tool upload the QR image anywhere?
No. Decoding and all risk analysis happen 100% in your browser — the image never leaves your device.
What does a 'clean' report actually mean?
It means no red flags were found in the static checks — not that the destination is proven safe. A brand-new phishing domain can pass every automated check. Treat a clean report as 'nothing suspicious detected', and stay cautious when money or logins are involved.
The QR doesn't contain a URL — what then?
QR codes can also hold Wi-Fi credentials, contact cards (vCard) or plain text. The tool decodes and shows any payload; the URL-risk checks only apply to web links, and the report says so.
What is a typosquat domain?
A domain deliberately close to a real brand's — paypa1.com instead of paypal.com, or micorsoft-login.com. They're built to survive a quick glance, which is exactly why scanning blind is risky.
Why are URL shorteners a red flag in QR codes?
A shortener hides the real destination — you can't tell where you're going until you arrive. Legitimate businesses printing QR codes have no reason to obscure their own address.
What should I do if I've already scanned a suspicious QR?
If you only opened it and entered nothing, you're likely fine — close it. If you entered card details or a password, change the password immediately, contact your bank, and watch statements. Don't install anything it offered.
Can I check a QR code with my phone camera instead?
Your phone camera shows a URL preview after scanning — that's a good habit. This tool goes further by analyzing the URL for phishing signals and decoding codes from photos you don't want to point your camera at twice.
Do parked QR stickers really get replaced by scammers?
Yes — it's one of the most reported quishing setups worldwide: a criminal prints a matching sticker and places it over the real parking-payment code. Always inspect the physical code for layering before scanning.
Is HTTPS enough to trust a QR destination?
No. HTTPS only means the connection is encrypted — phishing sites use HTTPS too. The domain itself is what matters, which is why the checker focuses on domain-level signals.