Is this QR code safe?

Purpose

Choose a photo or screenshot of a QR code and find out what it really does: open a website, make a call, send a text, join a Wi-Fi network or set up a payment, before you scan it with your phone.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Fake QR codes turn up on parking meters, letters, fines, emails and posters. Choose a photo or screenshot of the code: we read it in your browser, without uploading the image, and tell you what it does before you open it.

How to use it

1. 1

   Choose or take a photo

2. 2

   Already have the code’s content? Paste it here

3. 3

   Read the available fields alongside their limitations. An empty result does not prove safety or identify a person.

Synthetic example

https://parking.example/pay

Interpret the result

Don’t open it: The code shows signs of a scam. If you found it on a parking meter, a letter or a poster, pay or sign in from the official app or website, typing the address yourself.

Check before you confirm anything: We don’t see a clear scam, but the code does something worth reviewing before you confirm it on your phone.

No signs of danger: That doesn’t guarantee it’s genuine. Check that the address or destination is what you expect before you confirm anything.

Limitations

We never open the link: we only check it.

Troubleshooting

We couldn’t find a QR code in the image. Try a closer photo that’s in focus and without glare.

The image couldn’t be opened. Try a JPG or PNG photo.

The code’s content is too long to check.

Use with the API

What a decoded QR code really does: opens a link (checked with the country’s rules), calls or texts a number, writes an email, joins Wi-Fi, saves a contact, or asks for a payment (SEPA, Swiss QR-bill, UPI, Pix and other EMVCo codes, with IBAN and checksum checks) or crypto. The link is never opened.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/qr-check
POST https://api.nocall.io/v2/tools  {"tool":"qr-check","payload":"BCD\n002\n1\nSCT\n\nAparcamientos Ejemplo SL\nES9121000418450200051332\nEUR49.90\n\n\nMulta de aparcamiento 4471","country":"ES"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/qr-check' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"payload":"BCD\n002\n1\nSCT\n\nAparcamientos Ejemplo SL\nES9121000418450200051332\nEUR49.90\n\n\nMulta de aparcamiento 4471","country":"ES"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/qr-check',
    method='POST',
    data=json.dumps({'payload': 'BCD\n002\n1\nSCT\n\nAparcamientos Ejemplo SL\nES9121000418450200051332\nEUR49.90\n\n\nMulta de aparcamiento 4471', 'country': 'ES'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/qr-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ payload: 'BCD\n002\n1\nSCT\n\nAparcamientos Ejemplo SL\nES9121000418450200051332\nEUR49.90\n\n\nMulta de aparcamiento 4471', country: 'ES' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "qr-check",
    "result": {
      "payload": {
        "type": "payment",
        "scheme": "epc",
        "payee": "Aparcamientos Ejemplo SL",
        "account": "ES9121000418450200051332",
        "accountValid": true,
        "amount": "49.90",
        "currency": "EUR",
        "reference": "Multa de aparcamiento 4471",
        "country": "ES",
        "city": null,
        "crcValid": null
      },
      "signals": [
        "payment_request",
        "amount_prefilled"
      ],
      "attention": true,
      "hosts": [],
      "linkFlags": [],
      "link": null,
      "numbers": []
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• Check a link
• What is smishing?
• Safety tools