A QR code hides its address until you scan it, and most phones open the link in one tap. That is convenient, and it is why scammers like codes. In December 2023 the US Federal Trade Commission warned that scammers hide harmful links in QR codes, from stickers on parking meters to codes in unexpected texts and emails.
This checker reads the code and shows you what is inside before anything opens. It never visits the link. It looks at the address itself and points out the patterns that deserve a second look.
What the checker looks at
- The real domain. The part that decides who runs the site is the end of the address, just before the first slash.
paypal.com.secure-login.netbelongs tosecure-login.net, not PayPal. We pull it out and show it on its own. - Short links. Services such as bit.ly and tinyurl hide the final address. They are common and often harmless, but you cannot see where you will land.
- QR services in the middle. Many "free" generators put their own address inside the code, such as
qrco.deorqr1.be, and forward the scan from there. The owner can change the destination, and the code can stop working when their plan ends. - Lookalike letters. An address with
xn--in it uses letters from other alphabets that can look identical to Latin ones. - Tricks in the address. Text before an
@sign is ignored by the browser, an address made only of numbers skips the domain system, and plainhttp://sends the page without encryption. - Other kinds of code. For WiFi, contacts, texts, calls and emails we say what the phone will offer to do, so a "menu" code that actually sends a paid text does not surprise you.
Will this code stop working?
A code that holds the website address itself keeps working for as long as that website does. A code that holds a QR service's address only works while that service keeps forwarding it. If you are about to print a code someone made for you, check it here: if it goes through a QR service, ask who pays for it, or make a static code that cannot expire.
When a code looks wrong
- Do not type passwords, card numbers or codes sent by text into a page you reached from a QR code, unless you are sure of the domain.
- Look at the physical code: a sticker on top of another code, on a parking meter or a poster, is a classic sign.
- For payments, open the company's app or type its address yourself instead of scanning.
- If the address is wrong for the place you are in, tell the business. They may not know their code was covered.
What this check cannot tell you
A clean address is not proof that a page is safe, and a short link is not proof that it is dangerous. We do not visit the link, look up its reputation or follow its redirects, because that would send your code to a server. Treat the result as a careful second look, and use your judgement about the place and the request.
For the bigger picture, read are QR codes safe?
Common questions
Is the code I check sent to QRotto?
No. The image is read in your browser with the same decoder our scanner uses, and the address is examined on your device.
Why does it not open the link?
Because opening is the risky part. Copy the address if you want to look at it in a browser you trust.
Can it check a code on my screen?
Yes. Take a screenshot and drop it here, or paste it with Ctrl+V.