About QR Code Inspector
QR codes are a phishing vector — a poster slapped over a real café Wi-Fi sticker, a fake parking meter QR pointing at a credential-harvesting form. The QR Code Inspector decodes any QR image you drop in (or paste from clipboard) and runs a battery of checks against the payload before you ever open it on your phone. URLs are flagged for Punycode lookalikes, mixed scripts (homograph attacks), URL shorteners that hide the real destination, IP-address hosts, embedded credentials, suspicious TLDs, and unusual length. Wi-Fi configs are flagged when they're open / unencrypted. Plain-text payloads are surfaced verbatim. Decoding uses jsQR, locally — nothing is uploaded.
- No uploads
- Browser-only
- Works offline
- 100% free
How it works
- 1
Drop the QR image
JPG, PNG, WebP or GIF. The image is decoded locally with jsQR; the QR contents are extracted to text.
- 2
Read the safety report
URLs get parsed, classified and risk-scored. Other payload types (Wi-Fi, vCard, tel:) are surfaced with format-specific notes.
- 3
Decide
The summary aggregates findings into low / medium / high risk. Inspect the per-finding list to see exactly what was flagged.
Quishing: why QR codes became a phishing channel
Phishing by QR code — "quishing" — works because the URL is invisible to humans. A link in an email can be hovered, read, and judged; a QR code is an opaque square that your camera converts straight into a tap. Attackers exploit that blindness physically and digitally: stickers pasted over legitimate codes on parking meters (a scam documented across US and UK cities), fake Wi-Fi posters in cafés and airports, QR codes in emails that route around link scanners precisely because the URL is hidden inside an image, and counterfeit package-delivery slips asking for a 'redelivery fee'.
Regulators noticed: the US FTC published a consumer alert about malicious QR codes in late 2023, and the FBI's IC3 had warned earlier about QR-initiated payment fraud. Security vendors consistently report QR codes in a meaningful share of phishing campaigns — the channel is attractive exactly because the payload doesn't look like a link.
The defence is boring and effective: read the URL before anything opens it. That's the whole job of this inspector.
Every check the inspector runs
The decoded payload is classified (URL, Wi-Fi config, vCard, tel:, plain text) and URL payloads go through a battery of string-analysis checks:
| Check | What it catches |
|---|---|
| Punycode (xn--) detection | Internationalised domains that render as lookalikes of trusted brands |
| Mixed-script analysis | Homograph attacks — Cyrillic or Greek letters hiding inside a Latin domain |
| URL-shortener detection | bit.ly/tinyurl-class links whose real destination is hidden behind a redirect |
| IP-literal host | URLs pointing at raw IP addresses instead of a domain — rarely legitimate on a poster |
| Embedded credentials | user:password@host tricks that make the address look like a different site |
| Plain HTTP | Unencrypted destinations that expose whatever you submit |
| Suspicious TLD and length heuristics | Throwaway-TLD domains and abnormally long, redirect-chained URLs |
| Open Wi-Fi config | QR codes that join you to unencrypted networks |
Checks run as pure string analysis on your device — the inspector never contacts, resolves, or fetches anything.
How to read the risk score
Findings aggregate into low, medium, or high risk — and the score is deliberately cautious rather than clever. A bit.ly link is flagged even though plenty of bit.ly links are honest, because the property that matters (you can't see the destination) is true either way. Treat low as 'nothing structurally suspicious', medium as 'verify before trusting — there's a hiding place in this URL', and high as 'multiple deception patterns present; don't open it on a device that matters'. The inspector tells you what to verify; it doesn't pretend to know the attacker's intent.
Four situations worth the ten-second check
- Parking meters and EV chargers — physical sticker-over-sticker fraud is the canonical quishing attack; inspect before paying.
- Café and hotel Wi-Fi posters — a Wi-Fi QR that joins you to an open network deserves suspicion; the inspector flags missing encryption in the config payload.
- Payment QRs (UPI, SEPA, crypto) — decode first and confirm the payee identifier matches who you think you're paying, not a lookalike.
- Codes received in email or on package slips — the same message that would never survive your email filter as a link sails through as an image; screenshot it and inspect here before scanning with your phone.
What this tool deliberately doesn't do
The inspector never fetches the URL, never follows redirect chains, and never sends the payload to a reputation API — by design, since any of those would transmit what you scanned to someone else, and fetching a malicious URL is itself the thing we're avoiding. The trade-off: it can't tell you what's behind a shortener or whether a domain is on a blocklist. For that second opinion, paste the decoded URL into a reputation service you trust after the structural checks pass. Generating codes for your own use? The QR generator builds clean URL, text and Wi-Fi codes — and you can round-trip them through this inspector to see exactly what recipients will get.
Frequently asked questions about QR Code Inspector
Does the inspector open the URL?
No. The inspector only parses and analyses the URL string — it never makes a network request, never opens the URL, and never even DNS-resolves the domain. Everything is done by string analysis.
What's a Punycode / homograph attack?
Punycode encodes non-ASCII domains using ASCII (xn--…). It's used legitimately for international domain names, but attackers register domains where the Unicode form looks identical to a trusted brand — e.g. apple.com vs аpple.com (Cyrillic 'a'). The inspector flags both Punycode presence and mixed scripts in the displayed domain.
Why are some legit URLs flagged?
The checks are intentionally cautious. A short URL via bit.ly is technically risky because the destination is hidden — even if it's a trusted shortener for a known brand. Treat the findings as 'things to verify' rather than verdicts.
What if my QR contains plain text?
The decoded text is shown verbatim. It's classified as 'text' — no destination, no action. Just verify it doesn't contain commands you'd run blindly (some POS systems use QR-encoded shell commands).
Can I check a QR code from a photo of a poster?
Yes — photograph the poster, then drop the photo here. jsQR handles perspective and moderate blur. If decoding fails, re-shoot straight-on with the code filling more of the frame.
Can a QR code itself contain malware?
The code is just data — a few kilobytes of text. The danger is what handles that data: the website it opens, the Wi-Fi it joins, the payment it pre-fills. That's why inspecting the payload before acting on it covers the realistic attack surface.
Isn't my phone camera's preview enough?
The camera preview shows a truncated URL at best — long URLs, shorteners and homograph domains defeat it. The inspector shows the full payload and runs structural checks a one-line preview can't.
Privacy, offline use, browser support, and pricing questions are answered on the site-wide FAQ.