A QR scanner that shows you the link before it opens
TL;DR: ScanQR is a free QR code and barcode scanner for Android and iOS that never jumps straight to a website. It shows you the real domain first and warns about suspicious links. This post explains why we built it that
TL;DR: ScanQR is a free QR code and barcode scanner for Android and iOS that never jumps straight to a website. It shows you the real domain first and warns about suspicious links. This post explains why we built it that way.
π€ Google Play Β· π± App Store
Originally published on the Nexa Tech blog.
Many scanners open a link the instant they read a QR code. It feels fast. It also means visiting a website without ever seeing its address, which is exactly what a fake sticker on a parking meter is counting on. ScanQR adds one step: a preview. This post explains what that preview shows and why.
Anatomy of a suspicious link
Here is a made-up address of the kind found on fake parking stickers:
https://pay.citypark-0nline.com/meter/4471?ref=sticker
"pay" and "meter" make it look official, but the real domain (citypark-0nline.com) is not the city's, and the zero in "0nline" is a classic lookalike trick. Shown full size, it is easy to spot. Hidden behind an instant redirect, nobody sees it at all.
Every scan passes through a preview
- Scan a QR code or barcode
- Classify it: link, Wi-Fi, contact or text
- Preview it, with the real domain shown large
- Act: open, copy, connect or save
Nothing opens until the user decides.
What the preview shows for each type
| Content | Preview shows | Main action |
|---|---|---|
| Web link | Real domain, large, separate from the rest | Open in browser |
| Wi-Fi | Network name and security type | Connect |
| Contact | Name, phone, email | Save to contacts |
| Plain text | The text itself | Copy |
Signals we point out
- Shortened links: they hide where they really go.
-
Plain
httpwithout encryption. - Lookalike domains: a well-known name spelled slightly differently.
- Very long addresses where the real domain is pushed out of view.
A preview is not a guarantee. None of this proves a link is safe. It gives people the information to make their own decision, which is more than an instant redirect does.
Half a second of friction is a fair price for knowing where you are going.
Beyond scanning
Scans are saved to a searchable history on the device, so the menu from lunch or the event link from a poster is still there tomorrow. The same app generates codes for Wi-Fi networks and contact cards, which turned out to be popular with small shops and cafes.
Update: what ScanQR 2.0 added
Since this post first went up, the preview grew into a fuller set of features:
- More scam checks: raw IP addresses, look-alike characters, and links pretending to be banks or big retailers now get a warning before you open them.
- Payment QR codes: reads and creates Pix, UPI, SEPA/EPC GiroCode, Swiss QR-bill, PromptPay, VietQR and other EMVCo formats, so you can see who you're paying before your banking app opens.
- Product and book lookups: EAN/UPC and ISBN barcodes are looked up via Open Food Facts, Open Beauty Facts and Open Library.
- Every common format: QR, Data Matrix, Aztec, PDF417, EAN, UPC, ITF, Code 39/93/128 and Codabar.
- Private by default: no account, and history stays on the device. Available in 22 languages.
Try it free:
- Android: https://play.google.com/store/apps/details?id=com.nexa.qr_code
- iPhone: https://apps.apple.com/us/app/scanqr-qr-code-barcode/id6779862851
How do you handle link previews in your own apps? I'd love to hear other approaches in the comments.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.