Check a link or QR code before opening it
A link can carry a password-reset code or a key to a private file. Even the part after # can be a secret. Keep the whole address private until you know what it contains. Reading it in your browser and asking a server to visit it are different actions.
1. Copy the link without following it
For an unexpected link, use the message's copy-link option. For a QR code, open its photo or screenshot in QR code inspector. The inspector reads it on your device without opening a website, joining Wi-Fi or launching an app. Keep authenticator setup QR codes private; their contents can include the secret used to make sign-in codes.
2. Read what the QR code asks you to do
Look at the decoded text and its type. It could be a web address, contact details, a payment request or an action for an app. Check that it matches what you expected. For a warning about an account, open the service's usual app or a web address you know instead of following the message.
3. Check the spelling and clean up tracking
Look-alike domains can flag some misleading web addresses without visiting them. URL cleaner removes recognized tracking fields in your browser. Read the cleaned address before using it. Its site name and path can still contain private details, and removing part of a link may break it. Neither check proves that a site is trustworthy.
4. Keep private links out of the expander
Short link expander sends your address to this site's server, which follows its redirects after safety checks. The QR inspector's Expand safely button leads to that tool. Don't use it for password resets, private invitations, restricted downloads or any link carrying a private access code. Ask the sender for a normal public address or verify the request another way.
5. Expand a public link only if you're happy to share it
If you choose to check a public short link, read the redirect chain and final site name. Those sites receive requests from the checking server. A full link may still identify its intended recipient even without their IP address. The result doesn't scan for malware or promise the page will stay the same.
Good to know
The inspector can't judge every link, payment request or app action. Open anyway, following a link and using a tool that visits it are separate choices. HTTPS or a result without warnings doesn't prove that the sender or site is legitimate.