Daily tools · Tool

Safe QR code scanner

See what a QR code really contains before you open anything. Links are never opened for you.

Or paste a link or code text to check it

Everything happens on your phone. The camera picture and your photos never leave it, and nothing is saved.

What is "quishing"?

QR phishing: a fake QR code that sends you to a scam page. A code is just a picture, so you cannot tell where it leads by looking at it.

Stickers over real codes

Scammers stick fake codes on parking meters, payment devices, posters and café tables. UAE police have warned about exactly this. Do not scan a code that looks like a sticker or seems tampered with.

Read the real domain

The part just before the first single "/" decides which website you reach. "gov.ae.fines-pay.top" is the site fines-pay.top, not a government site. This scanner highlights that part for you.

Pay only through official channels

For fines, parking and government fees, open the official app or website yourself instead of following a code. Never type card details, one-time codes or passwords on a page you reached from a code.

Not only links

A code can also hold a Wi-Fi login, a phone number, a ready-written text message, an email or a contact card. This scanner shows each one and what it would do, and does nothing until you choose.

Sources: Abu Dhabi Police warning on fake QR code stickers on parking meters and payment devices (reported by Khaleej Times, 17 December 2025): pay only through official apps and government platforms, and don't scan codes of unclear origin. Dubai Electronic Security Center warning on "quishing" (28 October 2025): inspect codes before scanning, check the web address for misspellings and unusual endings, use official channels. Dubai Municipality advice (5 October 2025): check the link before opening it, don't enter sensitive data on QR-linked sites, scan only codes from known sources. The warning signs here are common indicators, not proof: a link with no warnings can still be a scam. QR decoding in browsers without a built-in detector uses jsQR (Apache License 2.0), hosted on this site.