Free QR Code Scanner
Got a QR code in a suspicious email, on a poster or in a PDF? Upload or paste it and see exactly where it leads, without opening anything. Free, no signup, and your image stays on your device.
Took a screenshot? Press Ctrl + V (⌘ + V on a Mac) anywhere on this page.
What you get
QR phishing works because nobody can read a QR code by looking at it. This tool reads it for you, so you can decide with the facts in front of you.
Read on your device
Your browser decodes the image itself. The picture is never uploaded to Cybereinforce or to anyone else.
Nothing gets opened
The content is shown as plain text. The tool never visits the link, so nothing on the other end learns the code was scanned.
Everything inside the code
Links, text, Wi-Fi details, contacts, phone numbers: whatever the code holds, shown in full and ready to copy.
One click to a verdict
Send any link or domain straight to our free IOC Lookup and see whether Cybereinforce blocks it.
Questions
What is QR phishing?
Attackers put a malicious link inside a QR code, often in an email pretending to be from IT, HR or a bank. Your phone opens the link, away from the protections on your work computer. It is also called quishing.
Is my image uploaded anywhere?
No. The image is read by code running in your own browser and is gone when you close or reload the page. If you choose to check a link in the IOC Lookup, only that link goes to Cybereinforce, for that lookup.
What should I do with a suspicious QR code?
Don't scan it with your phone. Read it here, check the link in our free IOC Lookup and report the message to your security team. If someone has already entered a password on the page, change that password and end their active sessions.
The scanner can't find my code
Crop the picture closer to the code and make sure it is sharp and shows the whole square, including its three corner markers. A screenshot usually reads better than a photo of a screen.
Why is a website named in the result when my phone shows something else?
Shortened links and redirects forward you to a different address after the first one. The scanner shows exactly what the code itself contains.
Protect every browser in your company
Cybereinforce checks every site your people open against our threat intelligence in real time and blocks phishing before a password is typed. Built for Microsoft Defender environments.
Start Free Trial Free IOC Lookup All community tools