June 1, 2026
QR Code URL Checker: How to Verify a QR Code Before Scanning
The most important security step when scanning a QR code is checking where it leads before opening the link. This guide covers tools and techniques for verifying QR code destinations.
Why URL Verification Matters
QR codes are just containers for URLs. The QR code itself cannot be malicious — only the destination URL can be. If you check the URL before opening, you can avoid most QR-related attacks.
What You Can Catch
| Threat | How URL Checking Helps |
|---|---|
| Phishing sites | Misspelled domains, unusual URLs |
| Malware downloads | .exe, .apk file links |
| Credential theft | Fake login pages |
| Drive-by downloads | Suspicious redirect patterns |
How to Preview QR Code URLs
Method 1: Built-In Camera Preview (Best)
Modern phones show the URL before opening:
iPhone (iOS 15+):
- Open Camera
- Point at QR code
- A notification banner appears with the URL
- Read the URL before tapping
Android (Google Play Services):
- Open Camera
- Point at QR code
- A popup shows the URL
- Read the URL before tapping
Method 2: QR Scanner App with Preview
Apps that show the URL before opening:
| App | Preview Feature | Platform |
|---|---|---|
| QR Scanner by Scan | Shows URL before opening | iOS, Android |
| Kaspersky QR Scanner | URL preview + security check | iOS, Android |
| SECUSO QR Scanner | Shows full URL | Android |
| Google Lens | Shows URL + preview snippet | iOS, Android |
Method 3: QR Code Decoder Websites
For QR codes in images (not in real life):
- Take a screenshot or photo of the QR code
- Upload to a QR decoder website
- The decoded URL is shown without opening it
Tools:
zxing.org(online decoder)- QR Code Reader browser extensions
What to Check in a QR Code URL
Legitimate URL Checklist
| Check | What to Look For |
|---|---|
| Domain name | Is it the correct company name? |
| Spelling | Are there typos (g00gle.com vs google.com)? |
| HTTPS | Does the URL start with https://? |
| Unusual characters | Random strings, excessive hyphens |
| URL length | Extremely long URLs are suspicious |
Suspicious URL Signs
| Red Flag | Example |
|---|---|
| Misspelled brand name | amaz0n.com, g00gle.com |
| Unusual TLD | yourbank-support.ru |
| IP address instead of domain | http://192.168.1.1/login |
| URL shortener for sensitive sites | bit.ly/payment-link |
| Excessive subdomains | secure-login.yourbank.fake.com |
QR Code Security Tools
URL Scanning Services
| Tool | What It Does |
|---|---|
| VirusTotal | Checks URL against 70+ antivirus scanners |
| Google Safe Browsing | Checks against Google's threat database |
| URLScan.io | Analyzes website behavior |
| PhishTank | Checks against known phishing sites |
| Kaspersky Threat Lookup | Security analysis of URLs |
Browser Extensions
| Extension | Feature |
|---|---|
| QR Code Reader and Scanner | Shows URL before opening |
| QR Code Security Scanner | Checks URL against threat databases |
Safe Scanning Workflow
For Personal Use
1. See QR code
2. Open camera app
3. Point at QR code
4. READ THE URL PREVIEW
5. Does the URL look correct?
→ Yes: Tap to open
→ No: Close camera, don't open
For Business Environments
1. Scan QR code with approved scanner app
2. App displays URL preview
3. Check URL against approved domain list
4. Check URL with security scanning tool
5. If approved, open the link
6. If suspicious, report to security team
Creating QR Codes with Trustworthy URLs
As a business creating QR codes, you should:
| Practice | Why |
|---|---|
| Use your own domain | Users recognize your domain |
| Use HTTPS | Users trust HTTPS links |
| Use clear URLs | yourdomain.com/menu vs shorturl.at/abc123 |
| Avoid redirects | QR → your page directly, not through redirects |
| Use dynamic codes | Update destination without changing URL |
Common Questions
Can I check a QR code URL without scanning?
No — the QR code must be decoded. But you can take a photo and upload it to a QR decoder website without opening the resulting link.
Do all phones show URL previews?
Most modern phones (iPhone 11+ / Android 2019+) show URL previews in the camera app. For older phones, use a dedicated QR scanner app.
Can a QR code URL change after I check it?
If it's a dynamic QR code (redirect), yes. The initial check shows the redirect URL, but the final destination may be different. Some QR scanner apps follow the redirect and show the final destination.
Creating Checkable QR Codes
Create QR codes with clear, trustworthy URLs — generate QR codes that your customers can verify before scanning.
Conclusion
Always check the URL before opening a QR code link. Your phone's camera shows the URL preview. Trust your instincts — if the URL looks suspicious, don't open it.
Create safe QR codes — generate QR codes with clear, verifiable URLs that build trust with your audience.