QR Code Security Check

The QR code is decoded on your device. Only the URL it contains is sent to the server.

The server then follows that URL's redirect chain one hop at a time, up to 10 hops, with a 5 second timeout, to see where it actually ends up.

Once the final destination is known, every host in the chain is checked against a small maintained blocklist and against public malware and phishing lists (URLhaus and OpenPhish), plus a few structural warning signs: an insecure (non-HTTPS) destination, a raw IP address instead of a domain, punycode domains that can look like a different site, embedded credentials in the URL, known link-shortener domains, and unusually long redirect chains.

The blocklist and phishing lists are downloaded and cached on the server periodically, not looked up live for each scan, so the URL you check is never sent to a third party.