Save your workspace key — shown once.
VNEY-3RJ1-X6MB-JS4X
Why it matters
It is the only way to reach these profiles and results from another
device. The lab stores a hash of it, so nobody here can recover it for you.
QR-016
(no app — decoding only) — Imported exact QR
pa — A payment needs a payee address. Nothing can be launched without pa.
Scan with the phone you want to test.
Advanced details
upi://pay
- Launch
- decode only
- Scheme
- (none)
- Profile
- P11 — The imported QR payload, byte-for-byte
- Platform
- Android + iOS
- Browser
- Any modern browser.
- Docs
- EMVCo merchant QR specification; NPCI UPI Linking Specification; ISO/IEC 18004 (QR). (npci spec)
- Reference
- —
- Registry
- 1.0.0
The ground truth. Your bank's own placard, unmodified, against each app — the baseline every edited copy is compared to.
Expected
For a QR the lab cannot decode — a vendor format, an encrypted payload, an ordinary web link — it says exactly that, shows the raw contents, and explains the limitation. It does not guess.
Limitations
- Decode-only. No app opens and no money can move, so this method is safe to run as often as you like.
- The lab will NOT fetch a web link found in a QR. Following an arbitrary URL that arrived in a QR is how a diagnostic tool becomes a phishing launcher.
Prerequisites
- Something to decode.
How the lab runs it
PayloadClassifier falls through to an explicit unsupported classification.