sniffQR: Scan Smart, Stay Safe

Know what is in a QR code before you act on it. Private by design.

sniffQR shows you what is really inside a QR code before you act on it, and tells you honestly when it cannot be sure. Free, in its entirety. SNIP IT, UPLOAD IT, OR PASTE IT Drag a box around any QR code on a page. If your selection catches more than one code, sniffQR highlights the one nearest the center and waits for your tap. It also takes an uploaded image, a copied image, or a copied link or text. No camera needed. NOTHING IS CHECKED UNTIL YOU SAY SO Every local check runs first, with zero traffic to any threat service. A URL goes to Google Web Risk only after you turn it on with your own API key, and then only the link you scanned and where it ends up. With it off, nothing leaves your browser except the redirect probe, which you can also turn off. PRIVATE BY DESIGN No accounts, no servers, no analytics, no ads. The extension keeps no history at all: one result, read and gone. Your API key stays in your browser's local storage and is never synced by us or sent to us. THE LOCAL DETECTION ENGINE RUNS RIGHT HERE No key, no account, no network needed. sniffQR reads the payload and its URLs for look-alike characters, brand impersonation, hidden characters, harmful file types, shell commands and the user@host trick, among others. Then it names what it found, in plain English. SOME OF THOSE LETTERS ARE LYING TO YOU A Cyrillic "а" looks exactly like a Latin "a". sniffQR detects look-alike characters across five scripts, names each finding down to the exact Unicode character, and shows you the real punycode address next to what you saw. IT WOULD RATHER SAY IT DOES NOT KNOW Four verdicts: Safe, Potentially Suspicious, Likely Malicious, and Unknown. A Safe verdict requires a threat-intelligence service to have actually said so. No check means Unknown, never Safe. Every non-Safe verdict explains itself in plain English. REDIRECTS, HONESTLY Following redirects is on by default and can be turned off in the options page. A browser shows an extension only the entry and final URL of a chain, so sniffQR says "via redirect chain" rather than claiming hop counts it cannot know. The sniffQR apps show every hop. THREAT INTELLIGENCE, WITH YOUR KEY Google Web Risk works with your own API key, off by default. VirusTotal, custom threat feeds and the offline database are app features: a browser extension cannot hold an offline threat database, and it says so instead of pretending. ELEVEN PAYLOAD TYPES URLs, Wi-Fi, contacts, email, phone, SMS, geo, crypto, 2FA, calendar and plain text, each with its own result card - including Open in Wallet for bare crypto addresses. The extension does what a browser can do and does not pretend to do the rest; the apps add the native actions. THE APPS The sniffQR apps add the camera, scan history, offline scanning, VirusTotal, custom threat feeds and more, for one payment, never a subscription. Android is out now on Google Play; iPhone is next. Screenshots show example scans. Service results in them are simulated. Requires Chrome or Edge 116+, or Firefox 115+.