Read a QR code without scanning it.

Why reading a code beats scanning it

A QR code is deliberately unreadable by people. That is the whole design: it is a machine format, and the only way to find out what it says is to let a machine act on it. With a link on a screen you can hover and read the destination in the corner of the browser. With a printed square you get nothing, and by the time you know where it goes, you are already there.

That gap is the reason QR codes became a phishing format. The attack does not need to be sophisticated. A sticker over the code on a parking meter, a table tent swapped in a cafe, a poster in a lobby: the code is physical, it is trivially replaceable, and nobody can tell by looking. Reading the image first closes the gap, because you get the destination without the visit.

What this page tells you that a scanner does not

Most online QR readers decode the image and print the raw text, which is the least useful half of the job. A string like https://xn--80ak6aa92e.com/ is technically the answer and tells most people nothing. This page reads the payload, works out what kind of thing it is, and then says what that means in plain terms.

• Web addresses get picked apart: whether it is encrypted, whether the destination is hidden behind a shortener, whether credentials are embedded before the @ sign to disguise where you actually land, whether the domain uses punycode, and whether it points at a bare IP address instead of a domain.
• Two-factor keys. An otpauth code carries the seed that generates someone's login codes. Anyone who scans or photographs it can produce valid codes for that account indefinitely. This is the single most sensitive thing a QR code can hold and the page says so.
• Wi-Fi codes store the network password as readable text, not encrypted. Fine for a guest network, a poor idea for the one your other devices sit on.
• Payment codes. Crypto addresses are a common swap target, and a transfer cannot be undone, so the address wants checking against a source that is not the code itself.
• Contact cards, calendar events, phone numbers and messages are shown as their actual fields rather than as one run-on string.

The trick worth recognising

Of everything above, embedded credentials is the one most people have never seen. A URL is allowed to carry a username and password before an @ sign, and browsers ignore everything before it when deciding where to go. So an address beginning https://your-bank.com@ does not go to your bank at all. It goes wherever the part after the @ points, and the familiar name at the front is decoration. In a QR code, where you never see the address before arriving, that is close to invisible. This page pulls it out and says so.

Punycode is the quieter version of the same idea. Domains can be registered in non-Latin scripts and are stored in an encoded form beginning xn--, which is entirely legitimate. It is also how lookalike domains are built, using characters that render like Latin letters but are not. The page reports it rather than accusing it, because the same mechanism serves both purposes and only you can tell which one applies.

What a clean result does and does not mean

If nothing is flagged, the code is not disguising where it goes. That is genuinely useful and it is not the same as the destination being safe. A perfectly ordinary https link to a domain nobody has ever heard of raises no structural flags at all, and this page has no opinion on whether the site behind it is trustworthy. It answers one question honestly rather than pretending to answer a bigger one.

For the next step, the decoded address hands off to our link decoder, which breaks down every tracking parameter riding on it, and to the redirect checker, which follows the chain hop by hop to the page it finally lands on. That combination, read the code then follow it without visiting it, is the part no plain QR scanner offers.

Making codes, rather than reading them

If you are on the other side of this and building codes to print, our QR code generator covers the two things that decide whether a printed code works: how large it has to be for the distance people scan it from, and whether the scans can be counted at all. It is also honest about the answer to the second one, which is that a code pointing at your own address cannot report its scans to anyone. For the background on that, what counts as a QR code scan and QR codes for restaurant menus both go further.