Loading page
About this tool
Compare a trusted merchant UPI QR payload with a current one locally, highlighting deterministic field differences without opening or initiating payment.
The Merchant QR Tamper Comparator puts a trusted UPI QR payload side by side with a current one and reports, field by field, whether they still agree. It parses each upi:// URI and compares eight fields — payment action, payee VPA (pa), payee name (pn), merchant ID (mid), fixed amount (am), currency (cu), transaction reference (tr) and transaction ID (tid) — under documented normalisation, and flags payloads carrying duplicate parameters or invisible Unicode controls as not checkable rather than guessing. Shop owners, auditors and anyone who maintains a printed QR at a counter get a deterministic difference report without any payment app being opened.
Open Merchant QR Tamper Comparator on AltFTool — it loads instantly in your browser.
Paste the trusted reference upi:// payload on one side and the current displayed QR on the other, or press Upload QR image for a JPEG, PNG or WebP file.
Tick the independently-trusted reference confirmation, then press 'Compare selected UPI fields'.
Read the matching, mismatching and not-checkable counts and the per-field table, then press Download counts-only report for merchant-qr-comparison-counts.csv.
Only upi: URIs are parsed, and they are read as text — nothing is launched, no payment flow is started, and any other scheme is rejected outright.
VPA and action are lower-cased, currency upper-cased, amount compared at two decimals and payee name whitespace-collapsed, so cosmetic differences are not reported as tampering.
Duplicate parameter keys or hidden bidirectional Unicode mark a field not-checkable instead of match, because an ambiguous payload cannot be safely compared by eye.
Eight: the UPI action (pay, collect, request or mandate), pa, pn, mid, am, cu, tr and tid. Fields missing from both payloads are reported as not checkable; a field present on only one side is reported as a mismatch.
No. The image is drawn to a canvas in your browser and decoded locally with jsQR, and the payload text never leaves the page. Uploads are limited to JPEG, PNG and WebP, and the decoder retries across nine overlapping regions of the image so a sticker photographed off-centre still reads.
It means the payload contains zero-width or bidirectional control characters (the U+200B-U+200F and U+202A-U+202E ranges, among others) that can make two different strings render identically. Any field containing them is marked not checkable, because a visual comparison of that field would be unreliable.
No. A mismatch means the two payloads differ, which can equally come from a legitimately reissued QR, a new transaction reference, or a different amount deliberately encoded. Treat the report as a prompt to verify with your payment service provider or bank through their own channel before accepting payments on that code.
Add the Merchant QR Tamper Comparator widget to your blog or website — free, responsive, no signup. Just keep the “Widget by AltFTool” credit link visible.
<iframe src="https://www.altftool.com/embed/widget/merchant-qr-tamper-comparator"
title="Merchant QR Tamper Comparator — free AltFTool widget"
width="100%" height="640" style="border:0;border-radius:12px;overflow:hidden"
loading="lazy" referrerpolicy="no-referrer-when-downgrade" allow="clipboard-write"></iframe>
<p style="font-size:12px;margin:4px 0 0">Widget by <a href="https://www.altftool.com/tools/all/merchant-qr-tamper-comparator?utm_source=embed&utm_medium=widget" rel="nofollow">AltFTool — free online tools</a></p>