QR codes: decode before you open
QR codes can hide payment addresses, login pages, Wi-Fi credentials, or malware links. Always decode and read the destination before your camera app opens it.
Use the QR Safety Scanner — ValidatesOnline never auto-opens the destination.
Read the payload before taking action
A QR code is a container for text. That text can be a web address, a payment instruction, a Wi-Fi configuration or ordinary information. Decoding reads the container; opening follows the instruction. Our scanner keeps these steps separate and shows decoded text without automatically visiting the destination. A successful decode establishes what is encoded, not who placed the code or whether it is safe.
Worked example: a parking sticker
Imagine a QR sticker attached over a printed parking sign. The decoded address uses parking.example.net, while the sign names an operator whose known website is example.com. Stop before entering card details. Check the operator’s address through an independent source or use the official app you already installed. A professional logo and an HTTPS connection do not establish that the payment page belongs to the operator.
Check the address precisely
Read the hostname rather than the surrounding brand text. In example.com.attacker.test, the destination belongs under attacker.test. Look for altered spelling, unexpected domains and encoded characters. A shortened link conceals the final destination; treat it as unresolved until you have verified it independently. Do not paste private login or password-reset links into public lookup services because their query strings can contain access tokens.
Payment and Wi-Fi payloads need different checks
For a payment request, inspect the payee and amount in the trusted payment app before authorizing. Do not enter a PIN merely because someone claims you must do so to receive money. For a Wi-Fi payload, confirm the network with the venue and remember that joining a network does not establish the safety of websites reached through it. Codes requesting an app download or account login deserve additional scrutiny.
If you already interacted
Decoding alone is different from submitting information. If you entered credentials, change them through the real service and review account sessions. If you authorized a payment, contact the bank through its official channel promptly. Keep the sticker photograph, decoded payload, time and transaction information. Do not revisit the suspicious page to collect more evidence or forward an active link to others without warning.