What the safety check actually does
We inspect the destination for HTTPS, punycode domains (xn--), bare IP hosts, embedded credentials and well-known URL shorteners. We also flag URLs with very long random parameters and combinations of a brand name on a foreign domain, which is the classic quishing pattern.
This is a heuristic, not an antivirus scan. It can tell you a link looks suspicious; it cannot certify a site as safe. That is why the scanner never opens links automatically: you always see the domain and make the decision.
Quishing: the recurring patterns
QR codes on parking meters, charging stations or fake authority letters repeatedly lead to cloned payment pages. Typical signs: a domain that almost matches the original, a short deadline and a payment request. Before paying, confirm the domain belongs to the organisation you expect.
If a sticker in public looks pasted on, or opens an odd address, stop scanning. Photograph it, check the destination here without opening it, and report it to whoever operates the space.
Why your images never leave the device
The decoder is JavaScript running in your browser. Camera frames are drawn into a canvas and read there; uploaded images are read through FileReader. There is no upload endpoint for image data. That is an architectural decision, not a slogan: the application has no route that accepts image content.
To improve the tool we store anonymous counters only — detected format, payload category (Wi-Fi, product code and so on), interface language, and whether decoding succeeded. No decoded content, no filenames, no IP-based profiling. Scan history lives in your browser’s localStorage and is deleted with one click.
When a code will not scan
The usual suspects are low contrast, a code that is too small, or reflections on a laminated label. Steady the camera, zoom slightly, and make sure the quiet zone around the code is visible. For a photo, rotating it often helps the decoder find the alignment pattern.
For damaged codes, try a second angle. For product barcodes we validate the EAN-13 check digit and tell you immediately when the number cannot be genuine. Industrial Data Matrix payloads (VDA 4902, GS1) are also supported — and our label generator handles the printing side.
FAQ
Questions fréquentes
Can this scanner detect malware?
No. It evaluates the destination for known risk patterns, does not fetch suspicious pages and performs no antivirus scan.
What is quishing?
Phishing through QR codes: a code leads to a cloned login or payment page designed to capture credentials or money.
Does the scanner open links automatically?
Never. You see the domain and risk hint first, then decide deliberately whether to open it.
How do I recognise a punycode domain?
It starts with xn--. We flag it, because lookalike characters can impersonate a brand.
Are file downloads from QR codes dangerous?
Yes, especially on Android. Do not install APKs from codes. The scanner shows executable file endings in the destination path.