Quick answer
Treat a QR code like an untrusted link. Decode it without automatically opening it, read the complete hostname, check the protocol, and consider the context in which the code appeared. A polished sticker or familiar logo does not authenticate the destination.
How to do it
- Scan with a tool that displays the full decoded value.
- Check HTTPS, spelling, subdomains, shorteners, and unusual protocols.
- Open only when the destination and requested action match your expectations.
Read the hostname correctly
In a URL such as login.example.com.attacker.test, the controlling domain is attacker.test, not example.com. Look from the slash back toward the left and identify the registered domain. Be wary of look-alike characters, extra hyphens, numeric IP addresses, and shortened URLs.
Pause before sensitive actions
Do not install an app, enter a password, send cryptocurrency, or approve a payment solely because a QR code asks. Navigate independently to the known service when possible. Physical codes can also be replaced with malicious stickers, especially on parking meters and public signs.
Common mistakes to avoid
- Trusting the label printed beside the code.
- Checking only that the URL begins with HTTPS.
- Allowing the camera app to open every result automatically.
Try the related tool
Use QRFoundry directly in your browser. Tool inputs and uploaded files are processed on your device.
Open Safe QR Code Scanner