Find the real destination behind Safe Links, URL Defense, Mimecast and other wrappers.
New
QR Code Decoder
Runs locallyNew
Use QR Code Decoder
What it does
Load, drop or paste an image of a QR code. The payload appears as defanged text together with what it does: a link and its real host, a Wi-Fi login, a payment request or a two-factor secret.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Parking payment link with a hidden host
https://pay-parking.example@198.51.100.24/pay?zone=401Web link read by jsQR (as is)
Payload (defanged)
hxxps://pay-parking[.]example[@]198[.]51[.]100[.]24/pay?zone=401
Copy raw
Text before "@" is not the destination: this link opens 198[.]51[.]100[.]24, not "pay-parking[.]example".
The host is a bare IP address (198[.]51[.]100[.]24), not a domain name.
HOST
198[.]51[.]100[.]24
USER INFO BEFORE @
pay-parking[.]example
SCHEME
https
PATH
/pay
QUERY
?zone=401
Next: use Send to… above. URL Parser splits the link into parts.Load example draws this text as a QR code on the page and decodes the image: the real host is the IP address 198.51.100.24, and pay-parking.example before the @ is only user info, so both are flagged as danger signs.
FAQ
What does the decoder show for a QR code?
The decoded text, defanged so it cannot be clicked, and its type: a web link (host, punycode, IP host, user info before @, link shorteners and wrappers), a Wi-Fi network, an e-mail, phone or SMS draft, a crypto, UPI or EMV payment request, an otpauth two-factor secret, a contact card or a calendar event. Each type gets the warnings that matter for it, for example that an otpauth code carries a 2FA secret.
Why does an image fail to decode?
The code may be too small, blurred, cut off at the edges or covered by glare; cropping to the code with its white border usually helps. The decoder tries the browser's built-in barcode detector where there is one, then jsQR on the image, a black-and-white threshold, an added white border and a 2x enlargement.
Is the image uploaded?
No. The image is decoded in your browser with the bundled jsQR library and is never sent anywhere. The camera is not used, so take a photo or a screenshot and load or paste it.