Can this tell me whether a QR code is a scam?

No, and no free tool can. It tells you which account the code pays, whether that IBAN is well formed, and which bank holds it. It cannot tell you whether the account belongs to the payee named in the code, whether the account is open, or whether the invoice is genuine. Checking that a name matches an account is Verification of Payee, and only the account holder's own bank can answer it.

Is my image uploaded when I decode a QR code?

No. The image is drawn to a canvas and decoded by JavaScript running in your browser. Neither the image nor the payload is sent to a server, logged or stored.

Which image formats can be decoded?

Anything your browser can display: PNG, JPEG, WebP, GIF and SVG. A screenshot of an invoice works, and so does a photo, as long as all four corners of the code and the white margin around it are in the frame.

Can it read a Swiss QR-bill?

It recognises one and says so, but it does not read the fields out of it. A Swiss QR-bill is the Swiss Payments Code defined by SIX, a different standard from the EPC payment QR, with its own element order. Naming it is honest; reading half of it by guessing at positions would not be.

Why does a decoded payload end in empty lines?

Because the generator that made it wrote every element, including the ones it left empty. EPC069-12 does not put a separator after the last populated element, so those bytes are surplus. Banking apps read the payload either way. The decoder counts them and says so rather than quietly trimming them.

Decode a Payment QR Code

Q: What does decoding a payment QR code show me?

It shows the exact text the code carries. An EPC payment QR (GiroCode) carries twelve data elements: a fixed header, the beneficiary bank's BIC, the beneficiary name, the IBAN, an optional amount in euro, and an optional payment reference. This page lists all of them, then validates the IBAN the code would pay.

Drop a picture of a payment QR code and read exactly what it carries: every EPC069-12 data element, the account it pays, and the bank behind that account. The image is decoded in your browser and never uploaded.

The code

Drop a picture of the code, choose a file, or paste a screenshot. The image never leaves your browser.

or drop one here, or paste a screenshot with Ctrl and V

Payload

What the code carries, character for character. Paste one straight in if you already have it, or edit what was read to see what changes.

Nothing read yet

Nothing has been read yet. Drop an image of a payment QR and this panel fills with the account it names.

What this reading covers

The payload, byte for byte
All twelve EPC069-12 elements
The account number
The national check digit
The bank it pays
Is the account open: its bank
Is the name the one on it: its bank
Is the sender real: nobody

Above the line: what a reading takes out of a code. Below it: what no code carries, and no free interface can answer.

What Is Inside a Payment QR Code?

A payment QR code is not a link and not an image of an invoice. It is a short block of text, laid out one field per line, that a banking app knows how to read into a transfer form. The European layout is EPC069-12, published by the European Payments Council and known in Germany and Austria as a GiroCode. It has twelve data elements: a three line header that says what the payload is, the version and character set, then the beneficiary bank's BIC, the beneficiary name, the IBAN, an optional amount in euro, a purpose code and a payment reference.

Everything a payer's app fills in comes from those lines, which is why reading them is worth doing before you pay. A code with a valid header and a well formed IBAN pointing at a different bank than the invoice claims looks identical to a correct one until you decode it.

What Decoding Can Tell You, and What It Cannot

Decoding answers questions about the code. It reads the payload byte for byte in the character set the payload declares, measures every element against the limits the standard sets, and runs the IBAN through the same engine as our IBAN checker: country, length, national structure, the ISO 13616 check digits, and, in the countries that define one, the national check digit inside the account number itself. It names the bank that holds the account and its BIC.

It cannot answer questions about the payee. Whether the account is open, whether it belongs to the company named in the code, whether the invoice is real: none of that is in the payload, and none of it has a free interface anywhere. Matching a name to an account is Verification of Payee, and only the account holder's own bank can perform it. A code can pass every check on this page and still be fraudulent.

QR Codes in Payment Fraud

Because the contents of a code are invisible until something scans it, a swapped code on an invoice or a sticker over a code at a counter changes where the money goes without changing anything a person can see. That is quishing. Reading the code before you pay turns an invisible instruction into a visible one: an unfamiliar IBAN, a country that does not match the supplier, or a beneficiary name that is not the one on the invoice all become plain text you can compare. If you want to know what each element in the payload above actually means, we walk through the EPC069-12 format field by field.

Plain IBAN Codes, EPC Codes and QR-bills

EPC payment QR (GiroCode): the twelve element payload above. A banking app pre-fills the whole transfer from it.
Plain IBAN code: the IBAN and nothing else. Useful for sharing an account, but the payer types the name, amount and reference.
Swiss QR-bill: the Swiss Payments Code defined by SIX, used on Swiss and Liechtenstein invoices. A different standard with a different element order. This page recognises one and says so rather than reading it with the wrong map.

Everything Happens in Your Browser

The image is drawn to a canvas and decoded by JavaScript on your device. The payload, the IBAN and the image itself are never sent anywhere, never logged and never stored, which is the same rule the rest of this site runs on. See our data methodology for how the bank directory behind the account lookup is built and checked.

Need to go the other way and produce a code? Use the IBAN QR code generator, which writes the same EPC payload and shows you every byte before you download it. The EPC QR code generator also checks the code against EPC069-12 rule by rule, and the GiroCode generator is set up for German invoices.

Last updated: September 2026