PRACTICAL GUIDE
How to Check Where a QR Code Leads
A printed square gives no clue where it points. How to read one from a photo before anything opens it, and what the sticker scams actually look like.
Last updated
The problem with a square of dots
Every other link you follow shows you something first. A hyperlink has text and, if you hover, a destination in the corner of the window. A QR code has neither. It is a machine-readable address printed as a pattern, and no human can tell one from another by looking.
That is fine when the code is printed on the packaging of something you bought. It is less fine when the code is on a sticker, and a sticker is the cheapest thing in the world to print and place over another one.
What the scams look like in practice
The pattern that keeps appearing: a parking meter, an electric-vehicle charger, a restaurant table, a parcel locker, a public notice. A sticker goes over the real code. The page it leads to is a competent copy of the payment screen people expect, and it takes a card number from someone who is standing in the rain and in a hurry.
The others arrive on paper. A letter about an unpaid fine, a delivery card, an invoice with a code instead of a bank reference. The code costs nothing to print and skips the part where you would have noticed a strange web address.
Why the camera preview is not enough
Most phones now show the address before opening it, which genuinely helps. It stops helping the moment the address is shortened, because a shortener shows you its own domain and not the destination, and shorteners are normal enough in legitimate codes that their presence proves nothing either way.
It also asks you to make a security judgement in one second, standing up, on a small line of grey text, with something else on your mind. Reading the code from a photograph puts the decision back on your terms.
Reading a code before you follow it
Photograph the code and decode the picture instead of scanning it live. You get the contents as text: the whole address, the network name, whatever is in there, sitting still, with nothing opening in the background.
Then look at the domain rather than the rest of the address. Everything after the first slash is chosen by whoever set the page up and can say anything at all, including the name of the company being impersonated. The domain is the only part that had to be registered.
Codes that are not links at all
A QR code can carry a Wi-Fi network and its password, a contact card, a calendar event, a phone number or a payment request. A Wi-Fi code is worth reading before scanning for a different reason: it hands your device a network name and a password in one motion, and it is worth knowing which network you just agreed to join. Reading the contents is also the fastest way to check a code you generated yourself before you print a thousand of them.
Frequently asked questions
Is the image uploaded to read the code?
No. The picture is decoded in your browser on your own device. That matters here more than in most tools, since the photograph often contains a letter, an invoice or a payment notice you have no reason to hand to anyone.
Why did it not find a code in my photo?
Usually the picture is too blurred, taken at a steep angle, or cropped so tight that the quiet margin around the pattern is missing — the decoder needs that border to find the edges. A flat, straight-on photo with a little space around the square almost always works.
Does reading a code tell me whether it is safe?
It tells you where it points, which is the piece of information you were missing. Judging the destination is still yours to do: check the domain against the one you expected, and treat a shortened address as unknown rather than as safe.
Can a QR code contain something harmful by itself?
The code is only data — text, a link, a network name. What it can do is send you somewhere harmful, or hand your device a setting you did not intend, which is why seeing the contents first is the whole point.