Scan & Generate
Free QR Code Link Checker
A QR code has no address bar. Paste the link your scanner showed you and this tool names the domain it actually opens, then flags the tricks used to disguise it. Nothing is opened, followed or uploaded.
Nothing is opened, followed, or uploaded. The link is taken apart as text, in this browser.
Private by design: the link is parsed entirely in your browser. Nothing is uploaded, logged, or requested. That matters here — a phishing link often carries a token tied to you personally, and pasting it into a server-side checker hands that token to a third party.
What This Checks, and What It Cannot
A QR code has no address bar. By the time a link is on your screen, you have usually already tapped it. This tool closes that gap: paste the text your scanner showed you, and it tells you the one thing that actually decides where you end up — the registrable domain — plus every trick commonly used to disguise it.
The checks are all structural, and each one is explained on screen rather than scored silently:
- The real domain. Everything to the left of it is a subdomain and can say anything at all.
paypal.com.secure-billing.topis asecure-billing.topaddress. - The @-sign trick. In a URL, everything before an
@in the address is a username and is ignored.https://paypal.com@evil.example/goes toevil.example. - Lookalike and punycode domains. Names beginning
xn--are decoded back to the characters they display, and a domain mixing Latin with Cyrillic or Greek letters is flagged. - Raw IP addresses, including the decimal and hexadecimal forms used to make one unreadable.
- Percent-encoding, decoded — including double-encoded links — so hidden characters become visible.
- Redirect parameters. A second URL smuggled inside
?redirect=or?next=is pulled out and inspected too. - Link shorteners, which are flagged as hiding their destination rather than as malicious.
- Non-web payloads — Wi-Fi credentials, contact cards, payment requests, one-time-password secrets — identified for what they are.
What it is not: a malware scanner or a blocklist. It never contacts the link, so it cannot tell you whether a page is currently serving malware, and it cannot expand a shortened URL — doing either would mean sending your link to a server. A clean result means "nothing structurally deceptive here", not "this is safe". Judgement still belongs to you.
Related Tools & Guides
Frequently Asked Questions
How do I check a QR code link without scanning it?
Use a scanner that shows you the decoded text before opening it, then paste that text here. Most phone camera apps display the link as a preview banner rather than opening it immediately — read the domain in that banner instead of tapping straight through. If the code is in an email or PDF, you can also screenshot it and decode it on a computer, where the full link is easier to read.
Which part of a link decides where it goes?
The registrable domain — the name plus its ending, such as example.com or example.co.uk — reading right to left just before the first single slash. Everything to the left of it is a subdomain that the site owner chooses freely, so login.microsoft.com.verify-session.top is a verify-session.top address, not a Microsoft one.
What does xn-- at the start of a domain mean?
It marks a punycode domain: an internationalised name written in ASCII so the DNS can carry it. Your browser displays the decoded characters instead. That is legitimate for genuinely non-English names, but it is also how homograph attacks work, because Cyrillic and Greek letters can look identical to Latin ones. This tool decodes the name and flags any domain that mixes scripts.
Can this tool expand a bit.ly or tinyurl link?
No, and that is deliberate. Expanding a short link means requesting it, which would send the link — and your visit — to a server. The tool identifies shorteners and tells you the destination is hidden. To see where one really goes, use a scanner app that resolves and displays the final URL before opening it.
Is a link with no warnings safe?
No. It means nothing structurally deceptive was found in the address. A perfectly ordinary domain can still host a phishing page, and a compromised legitimate site will look completely clean here. Treat the result as one input into your own judgement, alongside whether you expected the message at all.
Is my link sent anywhere?
No. The checker is plain JavaScript running in your browser, with no network requests and no storage. This matters more than usual for a security tool: phishing links routinely embed a token that identifies the recipient, so pasting one into a server-side checker can confirm to an attacker that the address is live.
Why does a QR code in a PDF deserve extra suspicion?
Because it is now the dominant delivery route. In Microsoft's Q1 2026 email threat report, PDF attachments carried 70% of QR code phishing by March, up from 65% in January. Putting the code in an attachment moves the link out of the message body, where automated link-checking usually happens, and onto a second device — your phone — that the organisation may not be protecting.
I already scanned a suspicious code. What now?
Scanning alone rarely does harm — the risk is what you do on the page that opens. If you entered a password, change it now and everywhere you reused it, and turn on two-factor authentication. If you entered card details, contact your bank. If you installed anything the page offered, remove it. If it happened on a work device, tell your IT team, because the same campaign has almost certainly reached colleagues.
Read the Link Before You Open It
Scan & Generate shows you the decoded text of every QR code before it opens anything, so you can read the domain first — and paste it here when something looks off.