QRAnalytica

How Do I Check If a QR Code Is Safe Before I Open It?

To check if a QR code is safe, read the link preview, find the real domain, run it through a link checker, and never pay or log in through it.

Nookesh Karri · 7 min read
Dark cover card with the title 'How Do I Check If a QR Code Is Safe Before I Open It?' in white and a lime accent bar

To check if a QR code is safe, look at the link preview your camera shows before you tap, find the real domain in that address, and run anything unfamiliar through a link checker such as Google Safe Browsing or VirusTotal. If the code is on a sticker, in an unexpected email, or asks you to pay or log in, skip it and go to the company’s site yourself. The code is only a container. The risk is the link inside.

The FBI’s advice boils down to one line: “check the URL to make sure it is the intended site and looks authentic.”

Your phone shows a QR code’s link before it opens anything, so the first check costs nothing. Apple’s instructions are to hold the camera over the code, “then tap the link to open the content.” The tap is the decision point. Don’t make it yet.

To read the whole address, press and hold the preview. The Swiss National Cyber Security Centre gives the same tip for links in general: on a smartphone, press and hold to see the full URL. If you copy it, paste it into a notes app, not the browser address bar.

Use the camera you already have. The FBI says: “Do not download a QR code scanner app. This increases your risk of downloading malware onto your device.”

Step 2: Find the real domain in the address

The real domain is the part right after https:// and before the next single slash. Caltech’s guide to reading URLs puts it exactly that way, and everything after the slash is just a page on that site.

Scammers count on you reading the left side and stopping. Caltech gives two worked examples:

What the link showsReal domainThe trick
imss.caltech.edu.example.comexample.comA trusted name used as a subdomain
www.bad-site.com?imss.caltech.edubad-site.comA trusted name added after the real domain

The Swiss NCSC adds three more warning signs:

  • Hyphens. “Using hyphens to mimic a legitimate name is a common tactic.”
  • Lookalike letters. Attackers swap in Cyrillic or Greek characters that look like Latin ones.
  • Odd endings. Domains ending in .top or .xyz rarely belong to legitimate businesses.

Don’t lean on the padlock either. Malwarebytes puts it plainly: “A phishing link with HTTPS is still a scam link.”

A real example: a parking sign with a code that previews as cityparking-pay.top/meter. The city’s name is there, but the domain is hyphenated and ends in .top. Two warning signs, and you haven’t tapped anything.

A short link hides the real destination, so you can’t check the domain at all. The Swiss NCSC says “scammers often use short links to hide where a link actually leads, especially in text messages,” and calls them rare in legitimate messages.

Plenty of businesses print short links, often on their own branded domain. A generic short link on a sticker gives you nothing to verify, though, so run it through Step 4 or skip it. More on the difference: QR codes vs short links.

A link checker compares the address against lists of known bad sites. Two are free:

  1. Google Safe Browsing. Google’s Safe Browsing service checks URLs against “constantly updated lists of unsafe web resources,” including phishing and malware sites. You can paste a domain into its site status search in the Google Transparency Report.
  2. VirusTotal. VirusTotal checks a URL with “over 70 antivirus scanners and URL/domain blocklisting services.”

Be careful what you paste into VirusTotal. Its scan reports are shared with the public VirusTotal community. A link that contains a personal token, such as a password reset or a private document link, shouldn’t go there.

To check the code image itself, QRAnalytica’s free QR validator decodes an uploaded QR image in your browser, so the image stays on your device. It flags look-alike domains, short links that hide the destination, and links without HTTPS.

Step 5: Check where the code came from

Where you found a QR code tells you as much as the link does. The FBI says to make sure a physical code “has not been tampered with, such as with a sticker placed on top of the original code.” Run a finger over the code. A raised edge or a code that doesn’t match the sign’s print is a reason to walk away.

Be warier still of codes in messages. The FTC says: “Don’t scan a QR code in an email or text message you weren’t expecting,” especially one that urges you to act fast. For more on these scams, read how to scan a QR code safely.

What a “safe” result can’t tell you

A clean link-checker result only means the site isn’t on anyone’s list yet. New phishing pages appear all the time, and a page set up this morning can pass every check.

Every tool here has this blind spot, the QRAnalytica validator included. Its own page says the check uses pattern matching and that no automated check catches everything.

My take: the checker shouldn’t make the call. What the code asks you to do should. If a code only opens a menu or a museum page, a quick domain check is enough. If it asks for a card number, a password or an app install, don’t use the code at all. The FBI’s advice is to “avoid making payments through a site navigated to from a QR code” and to type a known address instead. For apps, it says to use your phone’s app store.

Whether just opening the link can hurt your phone is a separate question, covered in can a QR code hack your phone.

FAQ

Can I see where a QR code goes without opening it?

Yes. Your phone’s camera shows the link as a preview before you tap it. On many phones you can press and hold that preview to copy the full address instead of opening it.

No. HTTPS only means the connection is encrypted. A phishing site can use HTTPS too, so check the domain name, not the padlock.

Google’s Safe Browsing site status search and VirusTotal both check a link against lists of known bad sites. A clean result only means nobody has reported the site yet, so still read the domain yourself.

Should I download a QR scanner app to stay safe?

No. The FBI warns that downloading a QR scanner app increases your risk of malware. The camera app on most phones already scans QR codes.

Sources

Track your dynamic campaigns. 7-day trial, no credit card.
Generate Dynamic QR

Keep reading

Guides How Do I Print a QR Code So It Scans Reliably? Guides Can Someone Hack Your Phone If You Scan a QR Code? Guides How Do I Make a Dynamic QR Code in Canva?