How to Check a QR Code’s Destination Before Opening It
A QR code tells you nothing until it is decoded. The printed label might say “menu” or “parking”, but the pattern can hold any address. Opening it before reading it hands the decision to whoever made the code.
The QR Scanner reads the code and shows the decoded content before you act on it. Decoding runs in the browser, and the camera image is not uploaded. That protects the image, not the destination: the page behind the link is a separate question.
Quick answer
Decode the code with a scanner that displays the payload without opening it. Read the full URL, check the scheme and the domain, and be suspicious of shortened links, raw IP addresses and look-alike spellings. If the address is unfamiliar or the request is urgent, stop. A code is a container for data, not a promise about where it leads.
Read the payload first
A scanner should show you the decoded text or URL and wait for a decision. If it opens the link automatically, you have lost the chance to inspect it. Use a tool that keeps the preview visible and read the content, not the label around the code.
Most codes hold a web address, but the format also allows plain text, a phone number, an email address or Wi-Fi details. The type matters: a code that opens a compose window does something different from one that opens a login page, and the context should match the label.
Read the address in the right order
Start with the scheme: https:// is the norm for a web page, while http:// sends data without encryption. Then look at the host, the part after the slashes. Read it from the right: the final label before the first single slash is the domain that matters, not the words at the start of a long subdomain.
Lookalike spellings are common: a doubled letter, a substituted digit, a hyphen added to a familiar name, or a different country ending. Punycode addresses beginning xn-- can represent non-Latin characters and deserve extra care. A raw IP address or an unusual port number is a reason to slow down unless it matches a context you understand.
Short links and redirects
A short link hides the final destination. Expand it or open it in a separate tab and read the address bar before typing anything. A redirect can land on a different domain, so check the final address, not just the first hop.
Do not enter a password, card number or one-time code on a page reached through an unexpected redirect. Legitimate services can usually be reached by typing the address yourself.
Check the situation as well as the URL
Physical codes can be replaced. A sticker over a menu, a car-park sign or a payment terminal may contain a different code. Look for peeling edges, a code on different material, or a label that does not match the surrounding print.
Urgency is another signal: a demand for immediate payment, account verification or an app install is asking you to skip the check. If you have opened a suspicious page, close it without entering anything. If you entered a password, change it from a trusted device and check the account.
Scan with QR Scanner, read the payload, and only then decide whether to continue. For the wider method, read How to Scan a QR Code Safely Before You Open It. For the common tricks, see QR Code Scams: What They Look Like and How to Avoid Them.
Common questions
Can I see a QR code's destination without opening it?
Yes, if your scanner shows the decoded payload before acting on it. The QR Scanner displays the text or URL and waits for you to decide. Check the full address, including the domain, before you open anything.
What does a safe QR code URL look like?
There is no reliable safe pattern. A familiar domain with https is a better sign than a look-alike spelling or a raw IP address, but the page behind it can still be dishonest. Read the host from the right, expand short links, and judge the request in context.
What should I do if I already opened a suspicious QR code?
Close the page without entering anything. If you entered a password, change it from a device you trust and check the account for activity. If you installed an app or granted remote access, remove it and contact the service or your IT support.