What is “quishing”?
Quishing (QR phishing) is when scammers use a QR code to send you to a fake website. Because you can't read a QR code by eye, it's an easy way to hide a malicious link. Common examples include fake stickers placed over real codes on parking meters and EV chargers, “missed delivery” letters, fake invoices, and emails asking you to scan a code to “re-verify” your account.
What this checker looks for
- Hidden destinations: link shorteners that hide where you'll really end up.
- Lookalike domains: brand names like PayPal, Amazon or a bank used on a domain that doesn't belong to them.
- Disguised addresses: raw IP addresses, unusual characters (punycode) and tricks like an “@” in the link.
- Risky files and schemes: app installers (.apk, .exe) and links that run code instead of opening a web page.
- Unencrypted pages that ask for details over plain http.
- Payment requests: crypto addresses and payment links, which are hard to reverse.
Red flags you should never ignore
- A QR code sticker placed on top of another one.
- Urgency: “pay now to avoid a fine”, “your account will be closed”.
- A page asking for card details, passwords or one-time codes right after scanning.
- A QR code in an email asking you to log in. Real companies rarely do this.
If you're unsure, don't scan through. Type the company's official address into your browser yourself, or use their official app.
How it works
The checker decodes the QR code on your device, then reads the link as text. It splits the link into its parts, such as the scheme, the domain and the path, and runs its checks against each one: known link shorteners, brand names on unrelated domains, swapped letters, raw IP addresses, punycode, risky file types and more. The verdict depends on what it finds. It never loads the page, so a malicious site has no chance to run anything during the check. The guide how to spot a QR code scam covers what to do next.