ABOUT

What is TheScanQR?

TheScanQR is a free browser-based QR code scanner designed to help you safely inspect QR codes before opening their destinations. In a world where QR codes are everywhere — from restaurant menus to payment systems — many people scan first and ask questions later. This tool reverses that approach: decode first, inspect the destination, then decide whether to open it.

Why TheScanQR exists

QR codes have become a common vector for phishing attacks and malicious websites. A QR code that looks like it leads to a legitimate restaurant menu or parking payment system might actually redirect to a fake website designed to steal your credentials or payment information. Traditional QR scanners open links immediately, giving you no chance to review the destination.

TheScanQR solves this problem by showing you exactly what a QR code contains and where it leads before anything opens. You can inspect the decoded URL, see basic safety checks, and make an informed decision about whether to proceed.

How it works

The scanner processes QR codes using two methods: live camera scanning for printed codes, and image upload for screenshots or saved photos. All QR decoding happens locally in your browser using JavaScript — your QR images are never uploaded to a server.

After decoding a QR code, the tool displays the exact content and runs several basic checks on web addresses. It flags common warning signs such as non-HTTPS URLs, raw IP addresses, suspicious URL shorteners, and other potentially problematic patterns. These checks can help identify obviously suspicious links, but they cannot guarantee that clean-looking websites are legitimate.

What TheScanQR checks

When a QR code contains a web address, the scanner performs several automated checks:

• Protocol inspection — Warns if a link doesn't use HTTPS
• Domain analysis — Flags raw IP addresses and suspicious patterns
• URL structure — Identifies potential issues with redirects and shorteners
• Credential leakage — Checks for embedded usernames or passwords
• International domains — Flags encoded international characters that could be used for spoofing

These checks highlight common warning signs, but they cannot detect every type of malicious website. Social engineering attacks often use legitimate-looking domains and valid HTTPS certificates, which would pass these basic checks.

Privacy and local processing

Your privacy is important. QR images you upload or capture are processed entirely within your browser and are never transmitted to our servers. The camera feed is processed locally, and no screenshots or recordings are saved.

The website uses Google Analytics to understand how visitors use the service, which pages are most helpful, and how to improve the tool. No QR content or scan results are included in this analytics data.

Limitations and disclaimers

TheScanQR is an inspection tool, not a security guarantee. It can help you identify obviously suspicious QR codes, but it cannot protect against sophisticated attacks that use legitimate-looking websites and valid security certificates.

The safety checks are designed to catch common red flags, not to provide comprehensive security analysis. When in doubt about a QR code's legitimacy — especially for payments, logins, or sensitive information — verify the link through an independent channel before proceeding.