Why This Matters
QR-codes have become so normalized in our daily lives over the last couple of years, and they are now used more or less everywhere. From restaurants to show menus, parking meters, payment systems, legally binding contracts and more. The convenience of using them has made them indispensible, but this convenience has also opened the door for malicious actors that can use our blind trust of them for their own agenda.
Unlike traditional URLs (website addresses) that we can read and evaluate before clicking on them, QR-codes hide their destination until after we have scanned them. This opacitiy, combined with their widespread use and our trust in the technology creates a perfect storm for social engineering attacks.
Most users don't realize that a QR-code is simply a way to encode data into a pattern of black and white squares, which is then scanned and decoded by a smartphone camera or QR reader. Once scanned, the data is interpreted by the device and the URL that was encoded could lead anywhere, like legitimate sites, phishing pages, malware downloads, or credential harvesting portals. It doesn't have to be a URL at all, but can be any data or text that the creator of the QR-code wishes.
The visual nature of the QR-codes also makes them easy to tamper with, a simple sticker placed over a legitimate code, or on a poster that shouldn't even have a code could redirect hundreds or even thousands of unexpected users to any page the threat actor decides.
This project aims to shed light on these risks and provide tools and knowledge to help users navigate the QR code landscape safely.
The Mission
This tool was created to bridge the gap between QR code convenience and security awareness. The goal is simple: empower users to make informed decisions about the links they're about to open.
By providing a quick verification step and educational resources about common attack patterns, we hope to reduce successful QR code-based attacks and foster a more security-conscious community.
Educational Focus
Security awareness is most effective when it's accessible and practical. This project emphasizes real-world scenarios and actionable advice rather than abstract threats.
The threat intelligence page provides detailed information about attack techniques, helping users understand not just what to avoid, but why these attacks work and how threat actors think.
Privacy by Design
This tool practices what it preaches. No tracking scripts, no analytics, no data collection, no cookies. When you check a URL, the analysis happens in your browser—nothing is sent to external servers.
The optional reputation check feature requires external API calls, but these are clearly labeled and only triggered when you explicitly request them.
Please note that this tool should not be the sole method you rely on for security decisions. It only looks at the URL and evaluates it based on certain heuristics and known patterns. It does not actually check the website that the URL leads to.
About the Creator
This project was developed as part of ongoing research and teaching in cybersecurity at the University of Borås and is being published under the Hidden Professor pseudonym. As educators, we have a responsibility to translate complex security concepts into practical knowledge that people can actually use.
The challenge with cybersecurity education is making it relevant without being alarmist, and actionable without being overwhelming. QR codes present a unique teaching opportunity because they're something everyone encounters regularly, yet few people consider the security implications.
This tool emerged from classroom discussions about the gap between security best practices and real-world behavior. Students often ask: "How do I actually check if something is safe?" This project is part of the answer.
For Educators
Feel free to use this tool in your own teaching and training programs. The QR generator feature allows you to create codes that route through this verification page first, making it perfect for security awareness demonstrations.
If you want to deploy your own instance from the source code or customize it for your institution, please make sure to credit this project. You are more than welcome to simply link to it as a resource. The goal is education, not ownership.
If you're incorporating this into curriculum or training materials, the threats page provides comprehensive coverage of attack techniques that can supplement your lesson plans.
Open Source
This project is open source and available for anyone to use, study, or adapt. Security through obscurity doesn't work—transparent, auditable tools build trust.
Community contributions, feedback, and improvements are welcome. The more people who understand and can verify how this works, the better.
The source code is hosted on GitHub under an open license. Feel free to fork, submit issues, or propose enhancements.
View on GitHubLimitations
This tool is educational, not comprehensive. It performs basic heuristic checks and provides guidance, but it cannot guarantee safety. No automated tool can replace human judgment.
Security is a continuous process, not a one-time check. Stay informed, stay skeptical, and always verify important actions through official channels.
Future Development
As you might have noticed, the reputation check doesn't work. It will be patched when there is time.
Cybersecurity threats evolve constantly, and so must our defenses. This project will continue to be updated with new attack patterns, improved detection logic, and additional educational content as the threat landscape changes.
Suggestions for improvements and reports of new attack techniques are always appreciated.
Get Started
Ready to check a QR link or learn more about threats? Use the verification tool or explore the detailed threat intelligence.