How to check where a QR code goes before opening it

Use the preview banner both iOS and Android show before opening, and read the domain immediately before the first single slash. To inspect without any risk of opening, decode the code with a scanner that displays the text instead of following it.

On the phone

iOS: the camera shows a yellow banner with the URL. Read it before tapping. Long-pressing the banner shows more options without opening.

Android: Google Lens and the camera app show the URL with an Open button. Read it first.

Neither opens the link automatically. The banner is your inspection point.

Reading a URL correctly

Find the first single slash after the scheme. Everything immediately before it, up to the previous dot-separated label, is the real domain.

URL	Real domain
`https://bank.example.com/login`	`example.com` ✅
`https://bank.example.com.evil.co/login`	`evil.co` ❌
`https://example.com.attacker.net/`	`attacker.net` ❌
`https://exarnple.com/login`	`exarnple.com` ❌ (rn, not m)

Watch for lookalike characters: rn/m, l/I/1, 0/O, and Unicode homographs from other alphabets.

Decode without opening

To see the raw text with no chance of navigation, use a decoder that displays rather than follows. Our scanner does this: point a camera or upload a photo, and it shows the exact string. It runs entirely in your browser — the image is not uploaded anywhere.

This is the right tool for inspecting a suspicious code, a code from an email, or a sticker you think may have been placed over a real one.

The red flags

A link shortener. The destination is deliberately hidden.
A domain that does not match the organisation on the printed material.
A request for credentials or payment on a page you reached by scanning.
A code in an unexpected email, particularly about MFA, payroll or deliveries.
A sticker over a printed code — feel for the edge.
An IP address instead of a domain name.
A data: URI, which can carry an entire page inline.

For payments specifically

Do not rely on the URL — payment codes often carry no URL at all. Instead, check the payee name your app displays against the business name printed beside the code. That is the check that catches sticker substitution, which is the dominant real-world payment QR fraud.

FAQ

Does my phone show the link before opening a QR code?

Yes. Both iOS and Android display the URL on a banner and wait for you to tap. Nothing opens automatically.

How can I decode a QR code without opening the link?

Use a scanner that displays the decoded text rather than following it. Our scanner does this entirely in your browser, so the image is never uploaded.

What part of a URL should I check?

The domain immediately before the first single slash. Attackers put a trusted-looking name in the subdomain, so bank.example.com.evil.co is actually on evil.co.

How do I verify a payment QR code?

Compare the payee name your payment app shows against the business name printed beside the code. Payment codes often have no URL to inspect, so the confirmation screen is the check.