QR code scanner online

See what the code hides before you open it

A QR code is opaque: looking at it, you have no way of knowing where it leads. That is exactly what “quishing” attacks rely on — codes stuck over legitimate ones on parking meters, menus or posters, leading to fake payment pages. That is why our scanner opens nothing automatically: it shows you the full address first, with the domain visually highlighted, and warns you when the link uses a shortener that hides the destination, an insecure connection, a numeric IP instead of a domain, or other patterns common in fraud. Only then do you decide whether to open it.

Check a suspicious link before opening it

When the scan result is a link, you also get an optional extra step: the “Check this link safely” button. The page behind the link is opened in an isolated environment, on Cloudflare infrastructure — not on your device — and you receive a screenshot of the page, its title, the full redirect chain and a clear verdict: green (looks safe), yellow (caution) or red (dangerous — recognised by the security scanner as phishing or malware). The check is opt-in: only the link is sent for analysis, and only when you press the button. Want to understand QR code fraud better? Read our guide to quishing →

Frequently asked questions

Can I scan a QR code without installing an app?

Yes. This page scans QR codes straight from the browser, on any phone or computer: start the camera or upload a photo or a screenshot containing the code. Nothing needs to be installed.

How do I scan a QR code from an image or a screenshot?

Press “Choose an image” and select the picture, drag the file onto the page (drag & drop), or paste it with Ctrl+V. The code is decoded instantly, locally, and the result appears below the tool.

Does my image reach any server?

No. Decoding happens entirely in your browser, with a local library. Neither the image nor the content of the code is sent anywhere — you can verify it: the page works without an internet connection once loaded.

Why does the link not open automatically?

For safety. QR codes are increasingly used for phishing (“quishing”): you cannot see the address before opening it. We show you the full link first, with the domain highlighted, plus warnings for link shorteners, insecure connections or suspicious domains. You decide whether to open it.

Why is my QR code not scanning?

The most common causes: the photo is blurry or too small (take it from closer), the contrast is poor (a light code on a light background), the code is damaged or covered, or the image is heavily compressed. Try a sharper photo, with the code straight and well lit.

Which QR code types does the scanner understand?

Links (with safety checks), Wi-Fi networks (we show the name and the password, with a copy button), vCard business cards (with direct saving to contacts), email addresses, phone numbers, SMS messages and plain text.

What happens to my link when I press “Check this link safely”?

Only the link — not the image, not the rest of the content — is sent to our server for analysis. The server passes it to the Cloudflare security scanner, which opens the page in an isolated environment, on your behalf, and analyses it for phishing and malware patterns. The analysed link is not stored and does not appear in logs.

Why is the screenshot blurred on a red verdict?

A red verdict means the security scanner recognised phishing or malware patterns in the page. Such pages convincingly imitate legitimate sites — banks, couriers, parking operators — and a clear screenshot could make you trust exactly what you should not. You can reveal it at any time from the “Show the screenshot anyway” button.