QR Code Checker: How to See Where a QR Code Goes Before You Open It

· Giovanni Fu Lin · url-shortener, qr-code, link-safety, phishing, security

Quick answer (updated 2026-10-29): a QR code is just text, usually a web address. To check one, let your camera read it but do not open it. Read the address in the preview, look at the real domain, and open the service yourself if the page asks for a password or a payment.

What a QR code checker can and cannot do

A QR code stores a short piece of text. Most of the time that text is a URL. Scanning does nothing else: the risk starts when you open the address, and the address is visible before that.

So the first “checker” is your phone camera. On both iPhone and Android the camera app shows the address in a banner or preview when it recognises a code. Read it there and tap only if it looks right.

Online QR checkers add one more step: they take the decoded address and look it up, or expand it if it is a short link. That helps, but it is evidence, not a guarantee. A page created an hour ago may not be on any threat list yet.

The 30-second check

  1. Read the address before you tap. If your camera shows only a vague label, long-press the banner or use a scanner that shows the full text first.
  2. Find the real domain. Read from right to left to the first dot-separated name before the path. In https://login.example.com.verify-account.invalid/pay, the site is verify-account.invalid, not example.com.
  3. Look for a shortened link. If the domain is a link shortener, the destination is hidden. Expand it with a redirect checker before opening it. See how to check a short link before clicking.
  4. Check the surface. If the code is a sticker over another code, on a damaged poster or on a parking machine, treat it as tampered with. Open the official site or app instead.
  5. Distrust urgency. A code that says “your parcel is held”, “pay now to avoid a fine” or “claim your refund” is a standard phishing pattern.
  6. Run an independent reputation check if you are unsure. Google’s Safe Browsing Site Status tool and VirusTotal both accept a pasted URL without you visiting it.

Warning signs in the address

  • A brand name in the wrong place: paypal.security-update.invalid is not PayPal.
  • Misspellings and swapped letters: rn for m, a zero for the letter o.
  • A raw IP address or a long string of random characters where a name should be.
  • An address that is HTTP, not HTTPS. Note that HTTPS alone proves nothing: phishing sites use valid certificates too.
  • A file download, such as an app or document, that starts without you asking for it.

Humans cannot read a QR code. With a text link you can at least see the characters. With a code you rely on the scanner to show you the destination, and many scanners open it immediately. That is why the habit that matters is a scanner that shows the address first, and a pause before the tap.

QR codes in public places add a physical risk. Anyone can print a sticker. If a code asks for money, a login or personal details, go to the business through its official app or website instead.

If you make QR codes yourself

The same logic works in your favour. A code that points to a short link is simpler to scan and you can change where it goes later without reprinting. It also lets you see how many scans it gets. We cover that in how to create a QR code from a short link and track scans.

ShortLink, the link tool from Fulin Labs, includes a free QR code generator that runs in your browser: it draws a PNG or SVG and does not upload the text you enter. It makes codes; it does not scan or decode them. Every destination is checked against Google Web Risk when a ShortLink is created, and anonymous links show the destination before sending anyone on.

What to do if you already scanned a suspicious code

  • If you only viewed the page, close it. Nothing more is needed.
  • If you entered a password, change it on the real site, turn on two-factor sign-in and check recent activity.
  • If you entered card details, contact your bank and ask to block the card.
  • If a file downloaded, do not open it. Delete it and run your device’s security scan.

A QR code is a convenience, not a trust signal. Read the address, check the domain and open important services yourself.

FAQ

How can I check a QR code without opening the link?

Point your phone camera at the code and read the address shown in the banner or preview, but do not tap it yet. A QR code only stores text, usually a web address, so the address on screen is what the code contains. Read the domain, then decide whether to open it.

Can a QR code be dangerous?

The code itself is only text, but the address it holds can lead to a phishing page, a malicious download or a payment request. Attackers also stick a fake code over a real one on posters, parking meters and menus, so a code in a public place can be tampered with.

What does a QR code checker actually check?

It reveals the destination and, in some tools, looks the address up against threat lists. It cannot prove that a page is honest. A new phishing page may not be listed yet, so a clean result lowers risk without removing it.

Is a QR code that points to a short link riskier?

It hides the final destination, so you cannot judge it from the code alone. Expand the short link with a redirect checker first. Some shorteners show the destination before redirecting, which makes the check easier.

Should I scan a QR code that asks me to sign in or pay?

Be most careful there. Close the page and open the service yourself through its app or a bookmark. Never enter a password, one-time code, card detail or wallet seed phrase after arriving through a QR code you did not expect.

Related project: ShortLink by Fulin Labs