# QR Code Decoder

URL: https://phishdestroy.io/developer-tools/qr-decoder
Category: Phishing URL & domain
Where it runs: Runs locally (nothing you enter is uploaded)

Load, drop or paste an image of a QR code. The payload appears as defanged text together with what it does: a link and its real host, a Wi-Fi login, a payment request or a two-factor secret.

## Example input

Parking payment link with a hidden host

```
https://pay-parking.example@198.51.100.24/pay?zone=401
```

Load example draws this text as a QR code on the page and decodes the image: the real host is the IP address 198.51.100.24, and pay-parking.example before the @ is only user info, so both are flagged as danger signs.

## FAQ

### What does the decoder show for a QR code?

The decoded text, defanged so it cannot be clicked, and its type: a web link (host, punycode, IP host, user info before @, link shorteners and wrappers), a Wi-Fi network, an e-mail, phone or SMS draft, a crypto, UPI or EMV payment request, an otpauth two-factor secret, a contact card or a calendar event. Each type gets the warnings that matter for it, for example that an otpauth code carries a 2FA secret.

### Why does an image fail to decode?

The code may be too small, blurred, cut off at the edges or covered by glare; cropping to the code with its white border usually helps. The decoder tries the browser's built-in barcode detector where there is one, then jsQR on the image, a black-and-white threshold, an added white border and a 2x enlargement.

### Is the image uploaded?

No. The image is decoded in your browser with the bundled jsQR library and is never sent anywhere. The camera is not used, so take a photo or a screenshot and load or paste it.

## Related tools

- [Link Unwrapper](https://phishdestroy.io/developer-tools/link-unwrapper)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)
- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)
- [QR Code Generator](https://phishdestroy.io/developer-tools/qr-code-generator)
- [Address Poisoning Checker](https://phishdestroy.io/developer-tools/address-poisoning-checker)

All tools: https://phishdestroy.io/developer-tools