How to scan a QR code from an image
- Press Choose image and pick a photo or screenshot of the code. On iPhone you can also take a photo right there.
- On a computer, you can drop the image onto the page or paste a screenshot with Ctrl+V or Command+V.
- The scanner shows what's in the code. For a link, it shows the site it really goes to in large type, then any warning signs.
A code on your phone's own screen works the same way: take a screenshot, then choose it here.
What is quishing?
Quishing is phishing with a QR code. A link you can read is easy to doubt; a code isn't, so scammers hide the link inside one. The FTC warns that scammers cover the real codes on parking meters with their own, and send codes by text or email with an urgent story, like a failed delivery or a suspicious login. It has also seen codes on packages nobody ordered. The code leads to a fake site that asks you to sign in or pay, or to a download.
The FTC's advice is to look at the link before you open it, and if a message pushes you to act now, to contact the company through a site or number you know is real. That's what this page is for.
What the warning signs mean
- The site isn't the company it mentions. The part of the address right before the first single slash is the site you'll be on. Inusps.com-track.info, that'scom-track.info, not USPS.
- A link shortener. Short links and QR code services hide the real destination until you open them.
- Not encrypted. An http link isn't private. Don't type a password or card number on one.
- A bare IP address, look-alike letters or an @ in the address.Real companies' links almost never look like that; these are ways to disguise where a link goes.
- Words about paying, tolls, fines, deliveries or your account. Scam codes lean on these to rush you. A real company won't mind you going to its site yourself.
- A file, a profile or an app. A code that downloads something or installs an app outside the App Store is a reason to stop.
- A crypto payment. Scammers send codes with their own wallet address, and crypto payments are hard to get back.
No warning signs doesn't mean a link is safe: a new scam site can look clean. It means nothing in the code itself looks wrong.
Already opened a bad QR code?
If you typed a password, change it, along with any other account that uses the same one. If you entered card or bank details, contact your bank and check your statements for charges you don't recognize. In the US you can report the scam at ReportFraud.ftc.gov. If Safari warned you about the site, what to do about a Deceptive Website Warning goes through the steps.
Wi-Fi QR codes
A Wi-Fi code holds a network's name, password and security type. The scanner shows all three, so you can join by hand. It flags a network with no password and one that uses WEP, an old security type that's no longer secure; weak security Wi-Fi on iPhone explains what to do about that.
What happens to your image
The image is decoded in your browser and never uploaded, and the page doesn't open or contact the link it finds. The checks run on the text of the code alone. That's also why it can't follow a short link or tell you what a site looks like today.
Questions
How do I scan a QR code from an image?
Press Choose image above and pick the photo or screenshot, or drop or paste it onto the page. The scanner reads the code on your device and shows what's inside, including where a link goes, before you open anything.
How do I scan a QR code that's on my phone screen?
Take a screenshot, then choose it here. Your phone's camera can't scan its own screen, but this page can read the code from the screenshot.
Is it safe to scan a QR code?
Scanning only reads the code; the risk is opening what it points to. Look at the link first. If it came on a sticker, an unexpected package, a text or an email that rushes you to pay or sign in, go to the company's site yourself instead.
What is quishing?
Quishing is phishing with a QR code. Instead of a link you can see, the scam hides it in a code on a parking meter, a flyer, a package or a message, and the code leads to a fake site that asks for a password or a payment.
Can this scanner tell where a short link goes?
No. Following a short link means visiting it, and this page never opens what a code points to. It tells you the link is shortened, so you know the real destination is hidden.
Is my image uploaded?
No. The image is read in your browser and never leaves your device. The page doesn't contact the site in the code either.