How It Ticks

Digital · Exhibit 7

QR code checker

Updated

Check a QR code link before it opens: choose a photo or a screenshot of the code, or point your camera at it. You see the whole address, with the part that decides whose site you’d land on in bold.

The picture is read in your browser. It isn’t uploaded, and the link in it isn’t opened.

Five checks before you open a code, whether or not you use this page:

  1. Feel it. A sticker stuck over another code, on a parking meter or a table, is a reason to pay another way.
  2. Ask whether you expected it. A code in a text, an email or a package you never ordered deserves doubt.
  3. Read the site name: the name just before the ending (.com, .co.uk), together with that ending, right before the first single slash. That is the site the link opens first.
  4. Stop at an @ in the name, a string of numbers instead of a name, or http:// instead of https://.
  5. Never log in or pay from a code you didn’t expect. Type the company’s address yourself.

Is this QR code safe?

You can’t tell from the squares, but you can tell a lot from the address. A QR code is only text written in black and white squares, and a code that leads to a scam looks exactly like one that leads to a menu. Scanning it only turns the squares back into text; the harm comes from the page it opens or the app it asks you to install. This checker reads the address and nothing more. It doesn’t look it up in any list of scam sites and never opens it, so it can’t promise anything about the page. Instead it lays the address out so you can judge it: the site name in bold, and a note for each trick that shows in the text.

Checking the address is what the FBI and the US Federal Trade Commission advise. The FBI’s advice from January 2022 is “once you scan a QR code, check the URL to make sure it is the intended site and looks authentic”; the FTC adds that if the address looks like one you know, you should “look for misspellings or a switched letter.” The FBI also says not to download an app from a QR code: get it from your phone’s app store. The checker points out a link that goes straight to an app or program file, such as .apk or .exe.

How do I know if a QR code is real?

Look at where it is before you look at where it goes. A sticker on a parking meter or on a restaurant table can sit on top of the real one: the FTC has reports of “scammers covering up QR codes on parking meters with a QR code of their own.” On a parking meter I’d skip the code and use the meter’s own app or the coin slot; two saved minutes aren’t worth it. A code in an email or a text message you weren’t expecting, especially one that says you must act now, deserves the same doubt. So does a package you never ordered, with a note telling you to scan a code to see who sent it. The FTC warned about that one in January 2025.

Then compare the site name with the company’s own. If a code on a bill from your bank leads to a name that isn’t your bank’s, type your bank’s address yourself instead of following the code.

Where does this QR code go?

Usually to exactly the address you see. In a static code the address is written into the squares, so what the checker shows is the first page the phone opens. That page can still send you on somewhere else, the way any website can. Some codes hold a short link from a service instead, like bit.ly. The phone visits the service first and it forwards you on, and that second step only shows up once the link is opened. So far the checker recognizes one such service, Bitly. For any other name it says it can’t tell whether a short-link service is behind it.

Which part of the address decides the site?

The name just before the ending, together with the ending, right before the slash that starts the path. paypal.com.account-check.example isn’t PayPal: the site is account-check.example, and whoever owns it typed everything in front. The checker finds that part with the same list browsers use to tell where one owner’s name ends, so it also knows that the site in shop.example.co.uk is example.co.uk, not co.uk.

The notes cover tricks you can spot in the text. An address that starts with http:// instead of https:// may load without encryption. A string of numbers in place of a name is unusual for a real shop or bank. If an @ comes inside the site name, whatever stands in front of it is only a login name, so https://paypal.com@example.net goes to example.net; some browsers ask before going, others just go. Letters that look Latin but come from another alphabet can spell a familiar name. And a long beginning full of words like login, secure or account says nothing about who runs the site.

Will the code I’m checking stop working?

Not by itself: the address is written into the pattern, so a static code works for as long as the page it points to is online. A short link from a service lasts as long as that service keeps it on, which is why codes from paid generators can stop working when a subscription ends. What Bitly and Canva say about their own codes is on the generator page, under do QR codes expire.

Are online QR code scanners safe?

Some send the link to their own server to look it up in lists of bad sites. This one sends nothing. The photo is opened and read by your browser, and the list of site names it needs comes from this site. The camera starts only when you press the button, its frames are read on your device and thrown away, and it turns off as soon as a code is found, after a minute without one, or when you leave the page. The privacy page says the same for the whole site, and the QR code exhibit shows how a phone reads the squares in the first place.

What this checker can’t tell you

Whether a site is run by crooks. A scam can sit on a clean-looking name, and an odd-looking name can belong to an honest café. It also can’t read every code. I tested it on 600 pictures made by my own QR code generator, 75 clean and the rest tilted, blurred, noisy, JPEG-crushed, tiny or on a busy background, counting the second try on a smoothed copy that it makes for every photo. It read between 92 and 100 percent of each kind. It missed most often when a large code was drawn so small that each square was only a few pixels wide, so if a photo fails, take it again closer, with the code filling most of the screen. The test didn’t include glare, curled paper, codes filmed off a screen or the camera itself.

Sources