QR X-Ray

How to use QR X-Ray

1. Drop a photo or screenshot of the QR code onto the box, click Choose image, or paste a screenshot with Ctrl/Cmd+V. On a phone you can also press Start camera and point it at the code.
2. QR X-Ray reads the code and shows exactly what it contains in the What the code contains box, with a label telling you what kind of code it is: a website, Wi-Fi network, phone number, text message, contact card, map location, payment request or plain text.
3. Read the verdict (Looks normal, Be careful or High risk) and the list of checks underneath. For links, the real domain is highlighted so you can see who actually owns the site.
4. Nothing opens automatically. If you’re happy with a link, press I’ve checked it, show the link and then open it in a new tab. Use Copy contents to keep the raw text, or Clear and scan another to start again.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

Why QR code scams happen

A QR code is just a picture of some text, usually a web address. You can’t read it by eye, so you only find out where it goes after your phone has already opened it. That’s exactly what scammers rely on. The trick even has a name: “quishing”, short for QR phishing.

In the UK the most common version is the fake sticker on a pay-and-display parking machine. A printed QR code is stuck over (or next to) the real one and leads to a copycat payment page that takes your card details. The same trick turns up on EV chargers, restaurant tables, posters and bus stops. Other favourites are fake “sorry we missed you” delivery cards pushed through the letterbox, letters claiming to be from HMRC or the DVLA, and emails that hide the link inside a QR code so spam filters can’t read it.

The fix is simple: look before you tap. QR X-Ray decodes the code without opening it, so you can read the full address first and spot the warning signs.

What the warnings mean

• Real domain highlighted: the part of the address just before the ending (like .co.uk or .com) is who owns the site. In paypal.com.secure-login.xyz the owner is secure-login.xyz, not PayPal. Everything before it can be set to anything.
• Brand name in the wrong place: names like PayPal, Amazon, Royal Mail, Evri, HMRC, DVLA, the NHS or a bank appearing in a site that doesn’t belong to them. It’s the number one phishing trick.
• Lookalike letters: swapped characters such as a zero for an “o”, or letters borrowed from another alphabet (shown as xn-- punycode) that look identical on screen.
• Link shortener or QR redirect: services like bit.ly, TinyURL or qrco.de hide the final address. Genuine businesses use them too, but you can’t see where you’ll land. QR X-Ray never visits links for you, so it can’t reveal the destination.
• Not encrypted (http), raw IP address or unusual port: signs of a quickly thrown-together site rather than an established business.
• Hidden “@” trick, encoded characters, links inside links: ways of disguising where an address really goes.
• App downloads: links to .apk, .exe or iPhone profile files try to install software outside the app stores. Treat these as high risk.
• Unusual domain ending: cheap endings like .xyz, .top or .click are popular with scammers. This one is only a nudge, as plenty of honest sites use them.
• Phone numbers and texts: 09, 118 and 070 numbers and five-digit short codes can cost a lot or sign you up to paid subscriptions.
• Crypto payment requests: crypto payments can’t be reversed, and no UK council, parking firm, delivery company or HMRC will ask for them.

The verdict adds these up. Looks normal means nothing obvious stood out, but it can’t promise a site is safe: a brand-new scam on an ordinary-looking domain can still slip through. If a code asks you to pay or log in, the safest move is always to open the company’s own app or type their web address yourself.

Privacy and browser support

Everything happens on your device. Your image and camera feed are never uploaded, logged or stored, and QR X-Ray never opens, fetches or “expands” the links it finds. Refresh the page and it’s all gone.

Where your browser has a built-in QR reader (for example Chrome on Android phones, Chromebooks and Macs) QR X-Ray uses it. Elsewhere it downloads a small open-source decoder (jsQR) from a public code library the first time you scan; your image still stays on your device. The camera option needs permission and only works on a secure https page. Uploading a photo or screenshot works in any modern browser.

FAQ

Does QR X-Ray open or visit the link?

No. It only reads the text inside the code. Nothing is opened until you confirm and press the open button yourself.

Can it tell me for certain that a link is safe?

No tool can. QR X-Ray checks for the warning signs scammers commonly leave behind, but a brand-new scam on an ordinary-looking address may not trigger any of them. Use the verdict as a second opinion, not a guarantee.

Why can’t it show where a bit.ly link goes?

Finding the destination of a short link means visiting it, which is exactly what QR X-Ray avoids. If a short link turns up somewhere you didn’t expect, ask the business for the full address or go to their website directly.

It says “No QR code found”. What now?

Try a closer, sharper photo with the whole code in view and even lighting, or crop the image so the code fills most of it. Screenshots work especially well. Very damaged or tiny codes may not be readable.

I think I’ve already paid a scam site. What should I do?

Call your bank straight away on the number on the back of your card, or dial 159 to reach most UK banks’ fraud teams. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (in Scotland, call Police Scotland on 101). You can forward scam texts to 7726 and scam emails to report@phishing.gov.uk.

Related: QR Code Generator, Password Generator, Security, Home.