QR code scanner
See exactly what a code contains before you visit it — the raw payload, where the link really goes, and whether the destination is flagged.
- Supported symbologies
- QR (all versions, plus Micro QR and rMQR) · Data Matrix · PDF417 · Aztec · EAN-13 and EAN-8 · UPC-A and UPC-E · Code 128, 39 and 93 · ITF-14 · Codabar · GS1-128 and GS1 DataBar
- Reading an EAN, UPC, Code 128 or ITF barcode instead? Use the barcode scanner.
——Following a redirect chain is a network call this page does not make, so a short link decodes to itself here.Scanning is not a redirect. Nothing is opened, nothing is logged against you, and no advertising appears at any point — the person scanning a code is never our customer.
Read the code before you trust it
QR phishing works because a code is unreadable to humans. A sticker over a parking meter or a restaurant table sends you somewhere you would never have typed. Decoding first — and following the redirect chain to its real destination — removes the entire trick.
Check the domain, not the design
A convincing landing page is trivial to copy. The domain is the only thing an attacker cannot fake, so read it before you type anything into the page.
Beware stickers over stickers
The most common physical attack is a fresh QR sticker placed over a legitimate one — on parking meters, restaurant tables and delivery lockers. If it peels, do not scan it.
Never enter payment details after a scan
A legitimate payment QR opens your UPI or banking app directly. If a scan leads to a web form asking for card or UPI PIN details, it is fraudulent.
Newly registered domains are a signal
Phishing domains are usually days old. We show registration age because a link to a domain created last week deserves more suspicion than the design alone would suggest.
Scanner questions
Is my camera feed or image uploaded anywhere?
No. Decoding happens in your browser. The video stream and any image you drop are processed locally and discarded when you leave the page.
Does it open the link automatically?
Never. That is the point — you see the destination first and decide. Nothing is fetched on your behalf except the safety lookup on the domain.
Can it read a damaged or blurry code?
Often, yes. Four independent decoders run in sequence, so codes that one library gives up on are frequently read by another.
Does it read barcodes too?
No — this page reads QR codes. Barcodes are a different shape with a different readout, so they have their own scanner: it reads EAN-13, EAN-8, UPC-A, UPC-E, Code 128, Code 39, Code 93, ITF and Codabar, and checks the check digit where the symbology defines one.
Why does it show the redirect chain?
Because a clean-looking short link can hop through several hosts to reach something malicious. Following the chain to its end is the only way to know where a code actually goes.
Decoded it and the payload looks right? The destination is what broke. If the scan lands on an expiry notice, the code did not expire — something behind it stopped answering.