Start with the situation
A code received without explanation, an urgent message or a sticker placed over another display deserves checking. A familiar logo and attractive layout do not authenticate the person distributing the QR code. “Quishing” means using a QR code to lead to a phishing attempt.
Ask whether you expected the link and whether the stated task makes sense: viewing a menu should not suddenly require your email credentials. If unsure, find the service through an address you already know or contact the sender through another channel.
Read the content without following the link
- If you have a PNG, JPEG or WebP image, open the Qurl reader.
- Select the image and examine the decoded text. Qurl does not open its destination automatically.
- For a full web address, compare the separately displayed domain with the one you expected.
- If you do not recognise the destination, stop before entering information there.
The reader processes the image in your browser without sending it to Qurl. It does not visit the destination, follow its redirects or scan it for malware. The displayed domain is a reading aid, not a safety verdict.
Identify what really belongs to the domain
A familiar service name can appear outside the hostname. In these fictional examples, addresses are displayed as text: there are no links to open.
Three fictional addresses to examine
https://qurl.be@example.org/menu- The hostname is
example.org. The part before @ is a username, not the website visited. https://qurl-be.example.org/menu- The hostname is
qurl-be.example.org, under the domainexample.org. It is notqurl.be. https://example.org/?next=https://qurl.be- The hostname remains
example.org. A parameter may contain another address without changing the initial host.
Similar-looking characters and some internationalised names also deserve attention. The reader flags a few unusual constructions; an address without a warning is not approved as safe. Qurl's generator rejects URLs with embedded credentials, even though a received QR code may contain one.
Understand what reading does not prove
The HTTPS prefix describes the connection protocol; it does not guarantee a website's honesty. A short or intermediary address can redirect elsewhere after opening. Qurl does not resolve that final destination: see our guide to static and dynamic QR codes.
A QR code may also contain text, contact details, Wi-Fi access or an instruction for an app. Check what the app proposes before confirming. In Qurl, decoded Wi-Fi details stay hidden until you ask to reveal them; their presence in the image still means anyone with the QR code can read them.
Try it without personal data
The resource library offers a fictional link PNG and its expected content. Download it, open it in the reader and compare both texts without opening the address. You can clear the result afterwards.
These examples and Qurl's software tests check decoding and domain display. They are not a database of trusted or malicious websites. Keep your devices updated and consult Safeonweb's advice if a message looks suspicious. Do not send support a questionable QR code containing confidential data.