| Guide | GDE-093 |
| Topic | QR code checks |
| Domain | Digital infrastructure |
| Last tested | 26 October 2026 |
Short answer: To check a QR code safely, decode it from a photo or screenshot with a QR code reader such as CyberChef, then trace the decoded link in urlscan.io before any phone opens it. The decoded address is only the first stop; redirects can lead elsewhere.
What does a QR code reader show you?
A QR code reader is a tool that decodes the text stored in a QR code, usually a web address, so you can read and check that destination before a phone opens it.
A QR code is a square barcode that stores a short payload: usually a web address, sometimes Wi-Fi details, a prefilled text message or plain text. Phones act on it almost instantly, which is why QR phishing, or quishing, works: fake codes on parking meters, posters and emailed PDFs lead to payment or login pages. Reading the payload as text first turns a one-tap risk into evidence that journalists and fraud researchers can examine and document.
| • | Checking a QR code on a parking meter, poster or flyer before anyone scans it |
| • | Verifying a QR code in an email, PDF or screenshot sent in a tip |
| • | Documenting a QR code scam for a story or a report to the operator |
How do you check a QR code without opening the link?
Decode the code from an image, read the payload as text, then trace the destination from a sandbox, not your own phone.
Status as of 26 October 2026, free tools first.
CyberChef: CyberChef, GCHQ's open-source data tool, decodes a QR code image with its Parse QR Code operation. Free, no login, and entirely client-side, so the image stays in your browser. Working.
ZXing Decoder Online: ZXing Decoder Online reads QR codes from an image URL or an upload under 10MB. Free, no login; the image goes to its server, so use it for public images. Working.
zbar: zbar is an open-source barcode reader whose zbarimg command decodes QR codes on your own computer. Free, no login, no upload. Working.
urlscan.io: urlscan.io loads a URL from its own servers and records the effective URL after redirects, a screenshot and the domains contacted. Free, no account for public scans, which other users can see. Working.
VirusTotal: VirusTotal checks a URL against security vendors' blocklists. Submitting means accepting its terms and sharing the URL with its security community. Not tested in this run.
What we tested: On 26 October 2026 we decoded six generated QR code images and a public-domain Wikimedia Commons sample, then traced the sample's decoded address. zbarimg and OpenCV failed on a 46-pixel copy, Redirect Detective returned a server error twice, and WhereGoes and VirusTotal were not tested because each asks for consent or acceptance of terms first.
1 of 1 generated code decoded correctly in the browser. | ||
2 of 2 sizes of the Wikimedia sample (330 and 120 pixels) decoded. | ||
4 of 5 generated codes decoded identically, including a rotated, blurred 123-pixel copy; both failed at 46 pixels. | ||
1 public scan recorded the sample's redirect to the Wikipedia main page, with no verdict. | ||
2 of 2 attempts returned a server permission error. | ||
A personal-data consent banner covered the form; we did not accept it. | ||
Submitting a URL counts as accepting its terms. |
A one-day snapshot from one connection in Switzerland, using seven clean inputs: it shows what each tool can read, not how often scanners catch real scam codes.
The Read-Before-Visit Rule: Decode a QR code to text and read the full address before any device opens it. Trace redirects in a sandbox, never on your own phone.