Can this tell me whether a QR code is a scam?

No, and no free tool can. It tells you which account the code pays, whether that IBAN is well formed, and which bank holds it. It cannot tell you whether the account belongs to the payee named in the code, whether the account is open, or whether the invoice is genuine. Checking that a name matches an account is Verification of Payee, and only the account holder's own bank can answer it.

Is my image uploaded when I decode a QR code?

No. The image is drawn to a canvas and decoded by JavaScript running in your browser. Neither the image nor the payload is sent to a server, logged or stored.

Which image formats can be decoded?

Anything your browser can display: PNG, JPEG, WebP, GIF and SVG. A screenshot of an invoice works, and so does a photo, as long as all four corners of the code and the white margin around it are in the frame.

Can it read a Swiss QR-bill?

It recognises one and says so, but it does not read the fields out of it. A Swiss QR-bill is the Swiss Payments Code defined by SIX, a different standard from the EPC payment QR, with its own element order. Naming it is honest; reading half of it by guessing at positions would not be.

Why does a decoded payload end in empty lines?

Because the generator that made it wrote every element, including the ones it left empty. EPC069-12 does not put a separator after the last populated element, so those bytes are surplus. Banking apps read the payload either way. The decoder counts them and says so rather than quietly trimming them.

Decode a Payment QR Code

Q: What does decoding a payment QR code show me?

It shows the exact text the code carries. An EPC payment QR (GiroCode) carries twelve data elements: a fixed header, the beneficiary bank's BIC, the beneficiary name, the IBAN, an optional amount in euro, and an optional payment reference. This page lists all of them, then validates the IBAN the code would pay.

Drop a picture of a payment QR code and read exactly what it carries: every EPC069-12 data element, the account it pays, and the bank behind that account. The image is decoded in your browser and never uploaded.

The code

Drop a picture of the code, choose a file, or paste a screenshot. The image never leaves your browser.

or drop one here, or paste a screenshot with Ctrl and V

Payload

What the code carries, character for character. Paste one straight in if you already have it, or edit what was read to see what changes.

Nothing read yet

Nothing has been read yet. Drop an image of a payment QR and this panel fills with the account it names.

What this reading covers

Checked here

The payload is read back byte for byte, in the character set it declares.
Every EPC069-12 element is measured against the length and format the standard sets.
The IBAN goes through the same engine as our checker: country, length, structure and the ISO 13616 check digits.
Where a country has one, the national check digit inside the account number is verified too.
The bank behind the account is looked up by its domestic code, with its BIC.

Not checked here, by anyone

Whether the account exists and is open. No free interface answers that.
Whether the payee name belongs to the account. That is Verification of Payee, and only the account holder's own bank can answer it.
Whether the person who printed the code is who the invoice says they are.

A code can be flawless on every point above and still be a fraud, because a valid IBAN is only evidence that the account number is well formed.

What Is Inside a Payment QR Code?

A payment QR code is not a link and not an image of an invoice. It is a short block of text, laid out one field per line, that a banking app knows how to read into a transfer form. The European layout is EPC069-12, published by the European Payments Council and known in Germany and Austria as a GiroCode. It has twelve data elements: a three line header that says what the payload is, the version and character set, then the beneficiary bank's BIC, the beneficiary name, the IBAN, an optional amount in euro, a purpose code and a payment reference.

Everything a payer's app fills in comes from those lines, which is why reading them is worth doing before you pay. A code with a valid header and a well formed IBAN pointing at a different bank than the invoice claims looks identical to a correct one until you decode it.

What Decoding Can Tell You, and What It Cannot

Decoding answers questions about the code. It reads the payload byte for byte in the character set the payload declares, measures every element against the limits the standard sets, and runs the IBAN through the same engine as our IBAN checker: country, length, national structure, the ISO 13616 check digits, and, in the countries that define one, the national check digit inside the account number itself. It names the bank that holds the account and its BIC.

It cannot answer questions about the payee. Whether the account is open, whether it belongs to the company named in the code, whether the invoice is real: none of that is in the payload, and none of it has a free interface anywhere. Matching a name to an account is Verification of Payee, and only the account holder's own bank can perform it. A code can pass every check on this page and still be fraudulent.

QR Codes in Payment Fraud

Because the contents of a code are invisible until something scans it, a swapped code on an invoice or a sticker over a code at a counter changes where the money goes without changing anything a person can see. That is quishing. Reading the code before you pay turns an invisible instruction into a visible one: an unfamiliar IBAN, a country that does not match the supplier, or a beneficiary name that is not the one on the invoice all become plain text you can compare.

Plain IBAN Codes, EPC Codes and QR-bills

EPC payment QR (GiroCode): the twelve element payload above. A banking app pre-fills the whole transfer from it.
Plain IBAN code: the IBAN and nothing else. Useful for sharing an account, but the payer types the name, amount and reference.
Swiss QR-bill: the Swiss Payments Code defined by SIX, used on Swiss and Liechtenstein invoices. A different standard with a different element order. This page recognises one and says so rather than reading it with the wrong map.

Everything Happens in Your Browser

The image is drawn to a canvas and decoded by JavaScript on your device. The payload, the IBAN and the image itself are never sent anywhere, never logged and never stored, which is the same rule the rest of this site runs on. See our data methodology for how the bank directory behind the account lookup is built and checked.

Need to go the other way and produce a code? Use the IBAN QR code generator, which writes the same EPC payload and shows you every byte before you download it.

Last updated: August 2026