Indicia

QR code safety checker

Upload or paste a QR code to see where it really leads, without opening it. Spots fake login and payment pages, lookalike domains, link shorteners, Wi-Fi and crypto payment tricks. Nothing is uploaded.

Runs in your browser. The image is never uploaded and the link is never opened.

How it works

The page reads the QR code from your image, works out what it would do (open a website, join Wi-Fi, start a payment, send a text) and explains it in plain words. Links are unwrapped from redirect services such as Safe Links, then checked for lookalike domains, link shorteners, bare IP addresses, open hosting, file downloads, login and payment pages, and hidden forwarding.

The link is never visited. To check its reputation with threat intelligence sources, look it up in Indicia.

Questions

What is quishing?
Quishing is phishing with QR codes. Scammers put codes in emails, on parking meters, posters and parcels, leading to fake login, payment or delivery pages. Email filters often can't read a link hidden inside an image, which is why criminals use them.
Does this open the link?
No. The QR code is decoded in your browser and the address is checked without visiting it, so nobody on the other end knows you looked. The image is never uploaded.
How do I check a QR code safely on my phone?
Take a screenshot or photo of the code and open it here. Many phone cameras also preview the address before opening it: read it carefully, and don't open it if anything looks off.
No warnings were found. Is it safe?
Not necessarily. This page checks the address for common warning signs, but a new phishing site on an ordinary-looking domain can pass. If you weren't expecting the code, type the organisation's address yourself instead.