Scope
What this guide helps you verify
Check a QR code received by email, text, poster or document and separate an expected HTTPS destination from a misleading domain or dangerous scheme.
Last reviewed: August 1, 2026
QR code security
How can you check whether a QR code is safe?
A QR image does not reveal its destination. Decode first, read the complete hostname and reject dangerous schemes before opening anything.
Key points
Short answer
- Decoding should never open content automatically.
- The scheme and full hostname matter more than the label near the code.
- Unexpected urgency, payment or login requests are warning signs.
- OnSubmit flags explainable local risks but cannot guarantee a remote site's safety.
What is quishing?
Quishing is phishing that hides a web destination inside a QR image. The image may bypass link inspection and move the user to a personal phone.
The matrix is not inherently malicious; risk comes from the encoded content, opened page and requested action.
Checks to perform
- Prefer HTTPS and reject javascript:, data:, file: or vbscript:.
- Read the hostname from right to left and identify deceptive subdomains.
- Check misspellings, lookalike characters, Punycode and unusual ports.
- Treat local IPs, localhost and shortened links with caution.
- Open the known app or official site directly when a QR asks for credentials or payment.
What local inspection can prove
| It can | It cannot |
|---|---|
| Show the exact encoded content | Guarantee future remote-site safety |
| Identify scheme, hostname and port | Detect every phishing page |
| Prevent automatic opening | Replace antivirus, DNS filtering or reputation checks |
| Flag obvious patterns | Prove the organization behind a domain |
Related tools
Apply the guide to real test data
Use these tools to generate, validate or structure the values explained in this guide.
Related guides
Continue with a connected topic
QR code guide Static vs dynamic QR codes: differences and use cases A static QR code stores the final data in the matrix. A so-called dynamic QR code usually stores an intermediate URL managed by a redirect service. QR code quality QR code print size, quiet zone and error correction Physical size depends on the number of modules, the quiet zone and the printed size of each module. Denser content needs a larger symbol.
Sources
Official and primary references
FAQ
Questions about this topic
How can I scan a QR code without opening its link?
Use a reader that displays decoded content first and requires a separate action to open a URL.
Can scanning a QR code instantly install malware?
Scanning normally decodes text. Risk increases when you open a page, download a file, install an app or submit information.
Does HTTPS prove a QR code is safe?
No. HTTPS encrypts the connection, but phishing sites can also have valid certificates.
What is a Punycode domain?
Punycode represents international domain names in ASCII. It can be legitimate or used for lookalike characters.
Why check QR codes in public places?
A fraudulent sticker can cover an official parking, menu or payment code.
Does OnSubmit guarantee link safety?
No. It performs explainable local checks and prevents automatic opening, but it is not a remote reputation scanner.