Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Scheme Safety Checker

Paste a QR destination and see its URL scheme classified — https, http, javascript:, data:, intent:, WIFI:, and more — with a risk verdict and what scanning it actually does. The classification recomputes on every edit, entirely in your browser.

1. Paste the destination

The scheme is the part before the first colon (e.g. https in https://…). The checker classifies that scheme against a fixed table — it does not fetch the destination.

Result
Scheme
https
Low

Encrypted web link. The destination can still be malicious, so the domain matters — but the scheme itself is the safe standard for QR destinations.

The Scheme Decides What Scanning Does

A QR code is not just a link — it is an instruction. The scheme tells the phone which app to open and what action to take: browse, dial, mail, join a network, or worse. Two payloads that look alike can do very different things, and the scheme is the part that decides. Checking it before printing is a one-second habit that catches the most dangerous class of QR mistakes.

A safe scheme is not a safe destination

Scheme checking is one layer. A safe scheme pointing at a phishing page is still phishing. Always verify the domain and the page content as well — especially for codes you did not create yourself.

Frequently Asked Questions

Does a "Low" risk scheme mean the destination is safe?

No. The scheme says what kind of action scanning triggers; it says nothing about the destination. An https: link to a phishing site is still a phishing site. Check the domain and the content separately.

Why is WIFI: rated medium?

Joining a network is a trust decision: the device may then send traffic through that network. The password is also embedded in the code in plain text, so anyone who scans it learns the password. WIFI: codes are fine for your own guest network, not for networks you do not control.

Why are javascript: and data: dangerous?

They do not point at a resource — they carry code or content that a mishandling scanner may execute or render. They have no legitimate use in a printed QR code, and most scanners refuse them.

What scheme should a QR code use?

https: for anything on the web, and the standard schemes (mailto:, tel:, geo:, WIFI:) for their specific jobs. If a destination needs an unusual scheme, that is a reason to reconsider the destination.