Got a QR code in a letter, on a parking meter or in a message? Check where it really leads before you scan it with your phone. The tool decodes the code without opening the link and flags common scam warning signs.
Point the camera at the code. Scanning happens in the browser only.
- or -
Try an example:
🔒 Everything runs locally in your browser only - no data is sent to any server.
Clicking VirusTotal sends the link (only) to Google's VirusTotal service for checking, in a new window.
⚠️ Whatever the Result - Stay Careful
Quishing (QR phishing) attacks rely on you not seeing the address before scanning. A fake sticker on a parking meter, a "fine" in the mail or a "package waiting" - all common scenarios. If you are asked to pay, sign in or enter card details after scanning, stop.
Open the official website yourself (type the address or use the official app), and never enter a password or verification code on a page you reached from an unfamiliar QR code.
💡 How to Spot a Dangerous QR Code
Sticker over stickerOn parking meters, charging stations and parking signs - check the code is not stuck over an original one. Rough surfaces or raised edges are a warning sign.
"Urgent" lettersA letter or email with a QR code demanding immediate action (fine, debt, package, account verification) is a classic scam pattern.
Check the domainThe real domain is the part right before the ending (e.g. gov.il or paypal.com). Words like "login" or a bank name elsewhere in the address mean nothing.
Shortened linksURL shorteners and "dynamic QR" services hide the real destination and allow changing it after printing.
Wi-Fi codesA code that joins a Wi-Fi network may connect you to an attacker's network. Only join networks the venue officially publishes.
2FA codesA code starting with otpauth is meant only for your authenticator app, right after you generated it on the official site. If someone sent it to you - it is an attack.
⚠️ Use of this tool is at your own risk. The tool and the information on this page are provided as general guidance and as a free service, AS-IS, with no warranty of correctness, accuracy or fitness for any particular purpose. The check is based on known warning signs (heuristics) and does not guarantee that a code is safe or dangerous - a code that looks fine may still be malicious. It is not a substitute for a professional security solution or for judgment. Ornet Communications shall not be liable for any damage, direct or indirect, resulting from the use of this tool or from reliance on its output.
This tool performs heuristic analysis only and is not a substitute for a professional security solution. Images and content are never sent to any server.
