Last updated 28 August 2026
Why reading before opening matters
A QR code is opaque by design. Nothing about the pattern tells you whether it leads to a menu, a payment page or something worse, and the sticker-over-a-real-code trick — quishing — works precisely because people scan first and look second. Most phone cameras now show the destination before opening it, but they show a shortened preview that can be truncated at exactly the point where a lookalike domain differs. Reading the full content as plain text removes that gap. This tool never follows what it finds: the decoded string is displayed, and opening it is a separate deliberate click. It uses the decoder already built into the browser rather than downloading a scanning library, which keeps the page light but does mean support depends on your browser.
Common questions
Why does it not work in my browser?
It uses the browser's own built-in barcode decoder rather than downloading a scanning library, which keeps the page fast and adds no third-party code. That decoder exists in Chrome, Edge and most Android browsers, but not yet in Safari or Firefox.
Is my image uploaded?
No. The image is decoded in your browser and never leaves your device. The same applies to the camera — the video stream is processed locally and nothing is recorded or transmitted.
Does it open the link automatically?
No, deliberately. The decoded content is shown as text and opening it is a separate click. Automatic opening is exactly the behaviour that makes malicious QR codes effective.
What is quishing?
QR phishing — placing a sticker with a malicious code over a legitimate one, often on parking meters, restaurant tables or payment terminals. Reading the full destination before opening it is the simplest defence.