Secure QR Code Scanner

The code itself is just encoded text and cannot carry a virus. The risk is entirely in where it sends you. A QR code is unreadable to humans, so it removes the one check people normally make before clicking — seeing the address first. That is what attackers exploit.

Quishing is phishing delivered through a QR code. A code is placed where people expect one — a parking meter, a restaurant table, a delivery notice, an invoice — and leads to a convincing fake of a real login or payment page. It works because a printed sticker over a genuine code is almost impossible to spot.

Read the decoded text, which is shown here before anything opens. Look at the domain immediately to the left of the first single slash — that is the real destination. Check spelling carefully, since swapped or doubled letters are the most common trick, and be wary of shortened links that hide the destination entirely.

A sticker sitting on top of another code. A domain that almost matches a brand but not quite. A link shortener where a business would normally use its own domain. A page asking for a password, card number or one-time code straight after scanning. Urgency of any kind — a fine to pay, an account about to close.

It removes one category of risk rather than all of them. Because decoding happens in your browser, the image never reaches a third party and no server keeps a record of what you scanned. It cannot, however, tell you whether the destination site is trustworthy — that judgement is still yours.

If you only viewed the page, close it. If you entered a password, change it immediately on the real site and anywhere you reused it. If you entered card details, contact your bank. If you approved a login prompt or entered a one-time code, treat the account as compromised and revoke active sessions.