QR Code Reader — Decode and Check a Code Before You Scan It

QR codes are unreadable to humans, which is exactly what makes "quishing" work — a sticker placed over a genuine code on a parking meter or a restaurant table looks identical to the real thing. Decoding it first shows the real destination before you visit it.

Usually blur, glare, a steep angle, or a cropped quiet zone — the blank margin around the pattern has to be intact for a code to be found at all. This tool also retries at reduced scale and with a hard black-and-white threshold, which recovers most photographs that fail on the first pass.

Only the part immediately before the top-level domain decides where a link goes. In paypal.com.secure-login.ru the site is secure-login.ru, not PayPal — everything to the left is chosen freely by whoever owns that domain. The check flags a known brand name appearing anywhere except the registrable domain.

It encodes non-Latin characters in a hostname, which is entirely legitimate for most of the world's languages. It is also how a lookalike domain is built, because several Cyrillic and Greek letters render identically to Latin ones — so the domain you read may not be the domain you reach.

No. The camera stream is read frame by frame into a canvas in the page, the decode runs on those pixels locally, and every safety check is computed from the decoded text itself. There is no reputation service, so nothing about the code you scanned leaves your browser.