Free · No app · No signup
Know where a QR code leads before you scan it.
Upload a photo or scan with your camera. We decode the code and check the destination for phishing and malware — right here, in a few seconds.
Bring your QR code to the checkpoint
Upload an image, or use your camera to scan it live.
Common quishing scams
These are the patterns behind most real-world QR code scams — recognizing the setup is often the fastest way to avoid falling for it.
Parking meters
A fake sticker placed directly over a real payment code, leading to a lookalike site that collects your card details.
Restaurant menus
A table-tent or menu code swapped for one that mimics the restaurant's real ordering or payment page.
Email & PDF phishing
A QR code embedded in an email or attachment, used specifically to slip past link-scanning security filters.
Fake delivery notices
A text or email posing as a carrier or agency, using urgency about a package or payment to get you scanning fast.
Recent checks
Off by default. If enabled, your last few checks are stored only in this browser — never sent to us, never synced anywhere. You can clear them anytime.
How the check works
Decode, on your device. The QR image is read entirely in your browser — it's never uploaded anywhere just to extract the text or link inside it.
Destination checked for known threats. If the code points to a web link, that URL — not your device, not the image — is checked against threat-intelligence data for phishing and malware.
Clear verdict, your decision. You get a plain-language result. We never open the link automatically — you decide what to do next.
Good to know
A "clear" result isn't a guarantee. It means the destination isn't currently flagged by Google Web Risk, the threat-intelligence data we check against — brand-new scam pages can briefly slip past detection. Stay cautious with anything asking for passwords or payment info.
We don't store your scans. QR images are decoded locally in your browser. Only the extracted destination link is sent for a safety check, and it isn't logged against you.