# How to check where a QR code goes before opening it

> Use the preview banner both iOS and Android show before opening, and read the domain immediately before the first single slash. To inspect without any risk of opening, decode the code with a scanner that displays the text instead of following it.

Source: https://useqr.app/docs/security/how-to-check-a-qr-code-before-opening · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## On the phone

**iOS:** the camera shows a yellow banner with the URL. Read it before tapping. Long-pressing
the banner shows more options without opening.

**Android:** Google Lens and the camera app show the URL with an Open button. Read it first.

Neither opens the link automatically. The banner is your inspection point.

## Reading a URL correctly

Find the first **single** slash after the scheme. Everything immediately before it, up to the
previous dot-separated label, is the real domain.

| URL | Real domain |
|---|---|
| `https://bank.example.com/login` | `example.com` ✅ |
| `https://bank.example.com.evil.co/login` | `evil.co` ❌ |
| `https://example.com.attacker.net/` | `attacker.net` ❌ |
| `https://exarnple.com/login` | `exarnple.com` ❌ (rn, not m) |

Watch for lookalike characters: `rn`/`m`, `l`/`I`/`1`, `0`/`O`, and Unicode homographs from
other alphabets.

## Decode without opening

To see the raw text with no chance of navigation, use a decoder that displays rather than
follows. Our [scanner](/scan) does this: point a camera or upload a photo, and it shows the
exact string. It runs entirely in your browser — the image is not uploaded anywhere.

This is the right tool for inspecting a suspicious code, a code from an email, or a sticker
you think may have been placed over a real one.

## The red flags

- A **link shortener**. The destination is deliberately hidden.
- A **domain that does not match** the organisation on the printed material.
- A request for **credentials or payment** on a page you reached by scanning.
- A code in an **unexpected email**, particularly about MFA, payroll or deliveries.
- A **sticker** over a printed code — feel for the edge.
- An **IP address** instead of a domain name.
- A `data:` **URI**, which can carry an entire page inline.

## For payments specifically

Do not rely on the URL — payment codes often carry no URL at all. Instead, check the **payee
name your app displays** against the business name printed beside the code. That is the check
that catches sticker substitution, which is the dominant real-world payment QR fraud.

## FAQ

### Does my phone show the link before opening a QR code?
Yes. Both iOS and Android display the URL on a banner and wait for you to tap. Nothing opens automatically.

### How can I decode a QR code without opening the link?
Use a scanner that displays the decoded text rather than following it. Our scanner does this entirely in your browser, so the image is never uploaded.

### What part of a URL should I check?
The domain immediately before the first single slash. Attackers put a trusted-looking name in the subdomain, so bank.example.com.evil.co is actually on evil.co.

### How do I verify a payment QR code?
Compare the payee name your payment app shows against the business name printed beside the code. Payment codes often have no URL to inspect, so the confirmation screen is the check.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate