Like a man says, "There are no problems, only solutions."
English

QR Quishing Detector

QR Quishing Detector

Scan QR or similar codes and see how risky a web address looks before opening.

Why

Quishing is phishing delivered as a QR code. A person cannot read a web address from a pattern of squares, so a fake parcel notice, parking sign or bank letter can send you to a look-alike site without any visible warning. Your camera usually opens the address straight away. This app puts a check between the scan and the visit.

What it does

  • Reads a QR code with the camera, or from an image you pick on your device. It also reads Data Matrix, Aztec and PDF417 codes and common barcodes such as EAN and Code 128.
  • Shows plainly what the code contains, with characters that can hide or disguise text, such as control and invisible characters, replaced by visible markers.
  • For a web address it can check, gives a risk rating of LOW, MEDIUM or HIGH, from checks that run offline on your device.
  • Explains the rating: every point of the score is traced to a named finding, so you can see why the address was rated as it was.
  • Optionally looks up how long the domain has been registered. This is off until you turn it on in the settings, and it is extra information only: it does not change the score.

Get the app

Coming soon to Google Play and the App Store.

Get it on Google Play Download on the App Store

Screenshots

The scanner: the camera view with a QR code, and a button to use a picture instead.
Scan with the camera, or pick a picture
A HIGH RISK result for an address that imitates PayPal, with the score, the domain and the findings that explain it.
A HIGH RISK result, with every point of the score explained
A LOW RISK result with its score and an explanation of what was checked.
A LOW RISK result: no suspicious patterns, and no promise that the address is safe
A result that also shows how long the domain has been registered.
Optional: how long the domain has been registered

Your privacy

The developer collects nothing: there is no account, no analytics, no advertising and no tracking, and the app keeps no history of what you scan. The app itself never visits the scanned address. Only if you choose to open it is the address handed to another app, such as your browser. Read the full privacy policy.

An aid to your own judgement

A result that has a risk rating is LOW RISK, MEDIUM RISK or HIGH RISK; other content is shown without one. This is a heuristic, structural check. A low score does not mean the link is safe, and a high score is not proof of phishing. When in doubt, do not open the link, and go to the organisation's official site or app yourself.

Credits

Part of the heuristic logic of this app, its checks and their weights, is based on the work of Nieves Casquero (qr_forense.py, MIT licence). See the source project quishing-detector on GitHub.

Contact

Report a problem or make a suggestion on the issue tracker on GitHub.