Safely Extract & Analyze QR Code Payloads.

Never scan a blind code. Upload suspicious QR codes to safely defang the hidden URL in a secure environment and cross-reference it against live threat intelligence.

Deep Analysis

What we investigate

We check 7 different signals to determine whether the QR code destination is trustworthy.

Secure QR code payload extraction and URL defanging

Hidden URL routing and redirect chain analysis

Live threat intelligence cross-referencing (Phishing/Malware)

Domain reputation, age, and registrar analysis

Visual tampering and overlay detection (Quishing)

Embedded text and obfuscated string detection

Final Url destination and risk scoring

How our detection process works

Simple, fast, and thorough analysis.

Upload the QR Code Image

Take a picture of the QR code you want to check and upload it here.

Run Image Analysis

Decode the content and expand any shortened URLs.
Check the destination against safety databases.

Review QR Forensic Report

Provide your a report describing risks and the true link.

Avoiding QR code scams

Know what to look out for in this industry.

QR codes are fast, but they can hide malicious links. Cyber-thieves are plastering suspicious QR code stickers everywhere from parking meters to menu boards at eateries. Our tool enables you to see where a code takes you without having to scan it through your phone.

How It Works

Upload an image of the QR code.
We automatically decipher it and reveal to you the entire actual URL it points to.
We check that URL against known phishing and malware sites in databases.

Common QR Code Scams

Phishing: It will trick you into going to a fake banking/payments page that looks real but is actually designed to snatch your login/credit card information.
Malware: The code tricks you into downloading a malicious app that can infect your phone.
Payment Diversion: A scam sticker on a parking meter or vending machine sends your payment to a thief instead of the city or company.

Why Check First?

Our program reveals to you the actual destination site, so it's easy to recognize a fake. For instance, a code for use at a city parking lot should be sent to MyCity-Parking.gov and not to Quick-Pay-Free.xyz. Let us protect you by revealing to you the reality before the click

Before you trust the image

Understanding Your Results

A QR scan gives you the real destination URL and checks it against known phishing and malware lists, it does not certify that every "clean" link is risk-free forever. A domain with no history in threat databases yet is not automatically safe; it just means nothing has been reported against it so far.

Weigh the signals together: a URL that does not match the context where you found the code (a parking-meter sticker pointing to a generic-looking domain instead of your city's official site) is a strong signal on its own. A shortened or redirected link that only reveals its final destination after several hops is worth extra caution even if that final destination is not yet flagged anywhere.

If you already scanned a code and entered a password or payment details on the page it led to, change that password immediately and contact your bank or card issuer.

Use visual evidence carefully

QR code verification questions

What is "quishing"?

Quishing is phishing carried out through a QR code instead of a link in an email or text. The code hides a malicious URL behind a scannable image, so you cannot see where it leads until you scan it, unless you check it first.

Is it safe to scan a QR code on a parking meter or restaurant table?

Not always. Scammers have placed fake QR code stickers over legitimate ones on parking meters, menus, and posters to redirect payments or steal information. Checking the code first, without opening it on your phone, shows you the real destination before you commit to anything.

Can a QR code install malware just from scanning it?

Yes, if the code leads to a site or file designed to exploit your phone's browser or trick you into installing something. This is why extracting and checking the URL first, rather than scanning directly with your phone's camera, matters for anything from an unfamiliar or public source.

How do I check a QR code without scanning it with my phone?

Upload a photo of the QR code to WebVetted's scanner. It decodes the payload, expands any shortened or redirected links, and checks the final destination against phishing and malware databases, all without your phone ever opening the link. For a broader look at phishing tactics generally, see the FTC's phishing guide.

Continue Your Investigation

Pivot your findings directly into these specialized intelligence modules.

Reverse Image Search

Find where an image has appeared before, surface exact and near matches, and spot reused scam photos or copied listing images.

Launch Tool →

Analyze AI Image (Fakes)

Check if an image is AI-generated, deepfake, or edited. Spot manipulation artifacts and stolen images.