QR Safety Check
Decode a QR code and flag suspicious traits such as shorteners, IP hosts and punycode domains.
QR & barcode Client-side Parsing + rule heuristics
Tool preview
How to use it
- 01
Drop a QR image or paste the content.
- 02
Read the warnings.
- 03
Decide before opening the link.
Limitations
- ! This is a heuristic check, not a reputation lookup against a threat database.
- ! A clean result does not prove the destination is safe.
FAQ
What is a punycode domain?
A domain encoded with non-ASCII characters, often used to imitate a familiar brand.
Why are shorteners flagged?
They hide the real destination, which is the most common trick in QR phishing.
Is the image uploaded?
No, decoding and analysis happen locally.
Files never leave your device
Processing happens in your browser using the File API, WebAssembly and Web Workers. There is no upload endpoint.
Technical details
- Processing
- Client-side
- Implementation
- Parsing + rule heuristics
- Category
- QR & barcode
- Network requests
- None while processing