Check what a QR code holds before you tap, pay or join.
The short version. A scanner can offer to open a code the
moment it reads it, and a long destination can be cut short to fit. SenseScan
reads it, lays out everything it contains, and waits. It has no internet
permission, keeps no history, and asks for one thing: the camera.
What it does
Nothing opens on its own. The safety here is refusing to
act until you have read what the code says.
The exact contents are shown in full, in a monospaced
font — so a capital I and a lowercase l stay apart. A password or a
two-factor secret waits behind one tap, so nobody beside you reads it
first, and contents longer than eight lines can wait behind one tap too,
so the screen leads with what the code says.
Payment codes get particular care. SenseScan reads
UPI, Pix, the Swiss QR-bill, the EPC QR code, Czech, Croatian, Slovenian
and pagoPA codes, and Bitcoin, Litecoin, Dogecoin, Ethereum and Solana
links. For these the account or address is shown largest,
because the name inside a code is whatever its maker put there. A
shop's QR code from a payment system SenseScan does not know is shown
part by part, exactly as written, and SenseScan says it does not know
who that money goes to.
A web address shows which part decides.paypal.com.secure-login.xyz is drawn with
secure-login.xyz in full strength and the rest dimmed,
because that is the site you would actually reach.
Characters that draw as nothing are marked. A zero-width
space or a right-to-left override can make a line read differently from
what it contains. SenseScan marks each one by its own code: a zero-width
space as <U+200B>, a right-to-left override as
<U+202E>.
More than one code is pointed out. Two codes produce a
choice, and nothing is read until you pick — so if a sticker leaves the
genuine payment code readable and both are in view, you are offered
both.
Product barcodes are checked offline against the
published GS1 rules: whether the digits add up, and which registry issued
them.
A picture or a link can be sent in. Share a picture of a
code, or a link or other text — or select text and choose SenseScan from
the menu — and it is read with no camera. Text is shown as text that was
sent, never as a scanned code.
Is this still my QR? A shop can save its own payment QR
under My shop and later check whether a sticker is still that QR. The QR is
kept exactly as it reads, on the phone.
Honest limits
It does not tell you a link is safe. It shows you what a
code contains and leaves the judgement to you.
It can never check reputation. With no internet access it
cannot know a normal-looking domain was registered yesterday for a scam.
Checking that would mean sending every code you scan to a server, which is
exactly what this app refuses to do.
A payment code's built-in check proves very little. When it
fails, SenseScan says so. That happens when a code is changed or
mistyped, or when its check was worked out wrongly — and in a code with
characters beyond plain letters and digits, it can happen with nothing
changed, when those characters were written in a way other than the
usual one. When it passes, that is not mentioned — it would mean only
that the code's own numbers add up, and anybody can make a valid code
for their own account.
Emphasising part of an address is not a verdict. It marks
which half decides. An unfamiliar name is not an accusation against anyone.
Detection is good, not perfect. In our own tests on
generated pictures, heavy glare and heavy damage stopped some codes being
read. In poor light, use the torch.
No independent security audit. The decoder (zxing-cpp) is
open source. This application of it has not been audited.