What does this QR really go to?

No. The decode happens entirely in your browser using the jsQR library on a <canvas> element. We never see the image, never store it, and never send it anywhere. The only network call happens later — when you choose to scan the decoded URL — and at that point we send only the URL itself.

Quishing is QR-code phishing: the attacker hides a malicious URL inside a QR code so you can't see the destination before tapping. It's the second-fastest-growing phishing channel because QR codes bypass URL-aware email filters (the link arrives as an image), are trivial to print and stick over real QRs in public, and exploit the assumption that QRs are 'just stickers'.

Yes — switch to the Camera tab. We request the rear camera, run jsQR on every video frame at ~6 fps, and the moment a QR locks in we surface the verdict and stop the stream. Frames never leave your browser. On supported devices we also expose a torch toggle for low-light scans.

Yes. Drop a PDF and we render every page locally with pdf.js, then run the same multi-QR decoder against each page. The first 20 pages of any PDF up to 32 MB are scanned. This catches the dominant corporate quishing vector — invoice / shipping label / DocuSign emails with a QR hidden inside the attached PDF that email-perimeter URL filters never see.

We surface every QR we find, not just the first. Useful for quishing posters that paste several malicious QRs over legitimate ones (e.g. parking-meter sticker swaps), and for security researchers reviewing a campaign of stickers. Each finding is rendered as its own card with its own verdict pill.

QR codes are the perfect smuggling vector for them — paypal.com and раура1.com look identical at a phone-screen glance, but the second is xn--ypal-pwc.com when round-tripped through Punycode. Whenever the decoded URL contains non-ASCII or a punycode label, we surface both the visible form AND the real ASCII form, and flag any host that mixes Unicode scripts (Latin + Cyrillic etc.) as a likely homograph attack before you click Scan.

Anything that fits the standard QR specification — Versions 1 through 40, all four error-correction levels, plus inverted (light-on-dark) codes. We don't yet decode the variant formats: Data Matrix, PDF417, Aztec, or MaxiCode. If you have one of those, let us know.

We classify it, lay out the structured fields (SSID, phone number, vCard name, …), and surface a tailored warning explaining what the specific risk is for that kind of payload. Most non-URL payloads aren't actively malicious — but a stranger handing you a QR that auto-dials a premium-rate number, or that joins you to an attacker-controlled Wi-Fi, is still worth a second look.

Because the whole point is to see the verdict before you load the page on your phone. Our URL scanner runs the link through 70+ antivirus engines, sandbox rendering (URLScan.io), Cloudflare Radar reputation, redirect chain tracing, and an AI arbiter that commits to safe / suspicious / malicious with cited reasoning. Takes a few seconds. Saves a lot of regret.