Malicious QR codes: how to check one before you scan

A QR code is safe to scan once you can see what it actually encodes before your phone acts on it — decode the pattern into plain text first, read the real destination, then decide whether to go there. The underlying problem is that a QR code is opaque to the human eye: unlike a typed link, there's no way to tell a legitimate code from a fraudulent one just by looking at it, and plenty of camera apps open the decoded link automatically the moment they recognize the pattern, skipping the chance to check it at all. You can break that automatic step with the Docuboxer QR reader, which decodes the image in your browser and shows you the raw content before you go anywhere.

Why a QR code is riskier than a typed link

A text link — even a disguised one — keeps some visible structure: you can hover over it, glance at the domain before clicking. A QR code offers none of that; it's a grid of black and white squares that only a reader can translate. That opacity is exactly what quishing (QR phishing) exploits, and it shows up in a handful of scenarios that keep recurring:

• Sticker overlays. The cheapest attack to pull off and one of the most reported: a fraudulent QR code printed on a sticker sized and finished to match, then stuck over the real one on a parking meter, an EV charging station, or a restaurant table tent. The physical context looks exactly as expected, so nobody thinks to question it.
• QR codes replacing links in phishing emails. Many email security filters scan URLs but not the content of an embedded image. Putting the malicious link inside a QR code sidesteps that filter entirely, and it forces the target to open the link on their phone — where scrutinizing the address bar tends to be harder than on a desktop.
• Fake posters in public spaces. "Scan to pay this ticket," "scan for free parking," or "scan to claim a prize" flyers rely on urgency and an unfamiliar setting — an airport, a new city, a municipal lot — to reduce the odds anyone stops to check where the code actually leads.

What to check in the URL once it's decoded

Decoding the QR code is only step one; what you do with the resulting text is what actually matters. When the content is a URL, there are four specific things worth checking before opening it:

• The real domain vs. a subdomain wearing a brand's name. yourbank.com and yourbank.com.verify-account.net are not the same domain — the part that counts is whatever sits directly in front of the first / after the root domain, not any fragment that happens to contain the brand name. yourbank.secure-login.info isn't your bank either: the real domain is secure-login.info.
• Shorteners that hide the destination. A shortened link doesn't reveal where it goes until you follow it, which cancels out the exact advantage of decoding the QR code by hand in the first place. A generic shortener domain where you expected a brand's own site deserves the same caution as a QR code you haven't decoded at all — the destination is still unknown.
• Lookalike characters (homoglyphs). Certain Unicode characters are visually near-identical to Latin letters — a Cyrillic "a" standing in for the Latin one, for instance — which lets attackers register domains that read as correct but aren't. If something about the domain doesn't sit right on a careful look, that's reason enough to stop rather than continue.
• Schemes that aren't http or https. A QR code can encode a link using an intent:// or market:// scheme designed to launch an app or app-store listing directly, bypassing the browser and its usual warnings. If the decoded text doesn't start with something you recognize, treat that as a signal to stop, not to proceed.

If the URL carries percent-encoded parameters and you want to see exactly what characters they hide, the URL encoder/decoderreverses that encoding into readable text — a useful extra step when a link looks like it's carrying hidden data.

A QR code isn't always a URL

Not every QR code points to a website, and each content type triggers a different action if your app processes it without asking:

• Wi-Fi credentials. A QR code of this type carries the network name and password as plain text: WIFI:S:MyNetwork;T:WPA;P:mypassword;;. Scanning it joins that specific network — one controlled by whoever posted the code, not necessarily the business you assume is offering it.
• Contact cards (vCard). These save a name, phone number, and email straight into your address book. The risk isn't technical so much as social engineering: a contact labeled as IT support or a coworker can set up a follow-on scam.
• Payment links. Increasingly common at restaurants and parking garages. The same domain checks that apply to any URL apply here, with more urgency — a fraudulent payment QR code doesn't just steal your attention, it steals your money directly.

Seeing the content type before your phone acts on it — opening a browser, joining a network, saving a contact — is the difference between you deciding and the QR code deciding for you.

The habit that actually works: decode, read, decide

The practical defense doesn't require memorizing lists of fake domains or installing anything — it's a fixed order of steps. First, decode the QR code into plain text using a tool that doesn't open the link on its own. Second, read the full destination — domain, scheme, parameters — with the same attention you'd give a suspicious link in an email. Third, decide, and only then, if you decide to proceed, open it. The QR reader is built for exactly that first step: it processes the image in your browser, never uploads it anywhere, and hands you the raw text so you can do steps two and three yourself.

If the QR code is one you're generating — to share a link, a guest Wi-Fi network, or a contact card — the QR code generator lets you check the result before printing it, and it's also a good way to see why QR was chosen over a linear barcode: it holds more data and tolerates more scan errors than a format like EAN-13 or Code128, which you can generate and compare with the barcode generator.

What this check doesn't cover

It's worth being honest about what decoding a QR code accomplishes and what it doesn't. Seeing the URL doesn't validate it — a domain can read as entirely correct, with no lookalike characters and no odd subdomain, and still be a fraudulent site registered that same week. The tool decodes the content; it doesn't check reputation databases or analyze whether the destination is safe, the same way a barcode reader doesn't tell you whether a product is genuine. And if the QR code links to a file to download — an installer, a PDF, an APK — checking the URL doesn't substitute for verifying that file's integrity once it's on your machine, which is what a hash generatoris for: comparing the file's SHA-256 hash against the one published by the official source confirms nothing was altered along the way.

Decoding before scanning meaningfully lowers the risk, but it doesn't eliminate it. The same rule applies as with any link: if something is pushing urgency, asking for payment details or credentials, or the domain doesn't match exactly what you expect, don't continue.

Frequently asked questions

Related tools

• Read QR code — Decode from an image or your camera, nothing uploaded to a server.
• Generate QR code — Create and check your own QR codes before sharing or printing them.
• URL encode/decode — Reveal what a link's percent-encoding is hiding.
• Generate hash — Verify the integrity of a file downloaded from a QR code's link.

You might also like: 13 privacy-first developer tools.