QR code scanner - see the link before you open it

Every other link you meet, you can read. You can hover it, look at the status bar, notice that the domain is wrong. A QR code removes all of that: it is unreadable to a human by design, so the first time you learn where it goes is when your phone is already going there.

That gap is the whole attack, and it has a name now — quishing. The common forms:

• Stickers over real codes on parking meters, EV chargers, restaurant tables and charity collection points. The sticker costs pennies and the payment page it leads to looks exactly like the real one.
• Codes in emails and PDFs, used specifically because a code is an image and most email security scans links as text.
• Fake invoices and letters that arrive on paper, where people are far less suspicious than they are online.
• Delivery cards pushed through the door asking you to scan to rearrange a parcel you were not expecting.

What a code can contain besides a link

QR codes carry arbitrary text, and several formats have side effects. A WIFI: code joins a network. A SMSTO: or tel: code opens a message or a call to a number that may be premium rate. A BEGIN:VCARD code adds a contact. A mailto: code opens a pre-written email. This tool names the type and shows the whole payload before any of that can happen.

Habits worth having

• On anything to do with payment, feel the code. A sticker over a printed code has an edge you can catch with a fingernail.
• Prefer typing the address yourself, or using the organisation's own app. A code is a convenience, never a requirement.
• If your phone's camera previews the URL before opening it, read it. If it does not, that setting is usually worth turning on.
• Be most careful with codes that arrive unprompted — in the post, in an email, on a card through the door.

How the decoding works here

The image is drawn to a canvas in this page and read back as pixels. It is converted to greyscale, thresholded block by block so a shadow across the code does not break it, then searched for the three large squares in the corners. Those give the orientation and the size of a module, which is enough to sample the grid, read the format information, undo the mask pattern and pull out the codewords. Reed-Solomon error correction then repairs whatever was misread — that is why a QR code still works with a logo printed over the middle of it.

All of it happens in your browser. Nothing is uploaded, which matters because QR codes appear on boarding passes, event tickets, prescriptions and bank statements.