UPI QR Code Scanner & Reader

Reading a QR only reveals the text inside it. What matters is what you do next. Scan to pay only when you mean to pay, check the payee name your UPI app shows before you enter your PIN, and never scan a code or enter a PIN to receive money: the Reserve Bank of India says receiving money does not need either. This page shows what a QR says, but it cannot tell you the QR is the one the shop meant to display.

A text link such as upi://pay?pa=shop@bank&pn=Shop&am=100&cu=INR. The pa part is the payee's UPI ID, pn is a name written by whoever made the code, am is an optional amount and cu is the currency. A static shop QR often has no amount, so you type it. The table above lists the other parameters.

A camera app only decodes the QR into text, and for a UPI QR that text is a upi:// link. Depending on the phone it may offer to open a UPI app or just show the link. This page takes the same text and splits it into the UPI ID, the name, the amount and notes, so you can read it before anything is opened.

In the NPCI draft, mode says how the link or QR was made, sign carries a digital signature and orgid is a 6-digit organisation ID, with 000000 for a merchant-created code. This page cannot check a signature. A simple QR may leave all three out, and the page shows that as a note, not as a problem.

Yes. A sticker can be placed over a printed code, and a swapped code pays someone else; the FBI has warned that physical QR codes are replaced this way, for example with a sticker over the original. A scan, here or in your UPI app, reads whatever is on top, so the check that matters is the payee name your app shows: if it is not the shop's name, stop and ask the shop. Shop owners can read our guide on preventing QR tampering.

The name inside a QR is text chosen by whoever made it, and nobody checks it. Your UPI app can show a different name for the same UPI ID. Treat the name your app shows as the one to compare with the person or shop you mean to pay. If neither name matches who you expect, do not pay.

No. The camera starts only when you tap Start camera, each frame is checked inside your browser and dropped, and the camera stops when you press Stop, when a code is read or when you leave the page. Photos and pasted text are read in the browser too. Nothing you scan, photograph or paste is sent to us or saved, and there is no scan history. Like every page here, the page itself is counted in cookie-free page-view statistics; see the privacy policy.

The browser needs a secure (https) page and your permission, and the site must be allowed to use the camera. If you tapped Block, allow the camera for this site in the browser settings. A camera may also be missing or in use by another app. A browser built into another app may not pass camera access to the page: open the page in your main browser. You can always use Take a photo or paste the QR text instead.

A upi://mandate code sets up a recurring debit, not a one-time payment. If you approve it, the payee can take money from your account again later. This page marks such a code with a warning. Approve one only for a subscription you set up yourself.

Some payment QR codes use the EMV merchant QR layout, which starts with 000201, instead of a upi:// link. This page reads the merchant name, city and amount from it and checks its built-in checksum (CRC), which only shows the text was not damaged. It cannot pay such a code: use the payment app or bank app you use for it. Our glossary explains Bharat QR.