QR safety lab
Run predictable QR destination checks directly in your browser.
No destination is visited or fetched; the decoded content stays available for review and copying.
- Release
- 2026-07-20-v1
- Updated
- Test cases
- 10
Summary
10/10 Pass
1
Clear indicates no matching structural warning in this release; it is not proof that a destination is safe.
5
Caution marks a destination structure that deserves deliberate review before opening.
3
Blocked prevents direct opening. The raw decoded content remains visible and can be copied.
Test matrix
| Test cases | Payload | Expected | Observed | Warning |
|---|---|---|---|---|
| Plain HTTPS destinationhttps-clear | https://example.com/docs | Clear | Clear | A conventional HTTPS URL with no release 1 structural warning. |
| Unencrypted HTTP destinationhttp-caution | http://example.com/docs | Caution | Caution | HTTP does not provide the transport protection expected from HTTPS. |
| Shortened destination URLshortener-caution | https://bit.ly/ | Caution | Caution | A short URL hides the eventual destination behind a redirect service. |
| Punycode hostnamepunycode-caution | https://xn--e1afmkfd.invalid/ | Caution | Caution | Punycode can represent internationalized hostnames that need careful visual review. |
| Public IP address destinationpublic-ip-caution | https://203.0.113.10/login | Caution | Caution | A public IP address is less recognizable than a named domain. |
| Tracking-heavy destination URLtracking-caution | https://example.com/?utm_source=poster | Caution | Caution | Numerous tracking parameters can obscure the meaningful destination path. |
| Embedded URL credentialscredentials-blocked | https://user:password@example.invalid/ | Blocked | Blocked | User credentials embedded in a URL can mislead readers about the true host. |
| Private-network destinationprivate-network-blocked | https://localhost/admin | Blocked | Blocked | Private or loopback network targets must not be opened directly. |
| Control character in destinationcontrol-character-blocked | https://example.invalid/\nnext | Blocked | Blocked | Control characters can change how a destination is displayed or interpreted. |
| Non-web intentnon-web-intent | mailto:hello@example.com | Not applicable | Not applicable | This payload invokes a non-web scheme and is outside direct web navigation. |
Methodology
- Checks are deterministic and run locally in the browser.
- No destination is visited, requested, or fetched during classification.
- Release 1 tests destination structure only, not the content or reputation of a site.
- Results are based on the decoded payload exactly as supplied to the checker.
Limitations
- Clear is not proof of safety, legitimacy, or harmless content.
- This release does not follow redirects, query APIs, or inspect destination pages.
- A blocked result disables direct opening, while keeping raw decoded content visible and copyable.
- Classification cannot replace user judgment or an organization’s security controls.
QR Safety Lab citation information
Research and data about local structural checks for QR destinations. Structural checks do not prove that a destination is safe.
- Publisher
- QR Code Crafter, Brand Aspect LtdCompany Registration Number: 05105266Legal information
- Suggested citation
- QR Code Crafter. “QR Safety Lab.” Release 2026-07-20-v1. Brand Aspect Ltd, July 20, 2026. https://qrcodecrafter.com/qr-code-safety-lab
- Corrections
- Report factual errors or problems reproducing this release. contact@qrcodecrafter.com
Compatibility scope
Scanner compatibility
This release measures destination structure only; it does not measure scanner or device behavior.
Real device and scanner compatibility is planned for a future release with separate measurements.
Frequently asked questions
- Does this tool open the QR destination?
- No. All checks are local and deterministic, and no destination is visited or fetched.
- Does Clear mean the link is safe?
- No. Clear only means release 1 found no matching structural warning.
- What happens to blocked destinations?
- Direct opening is disabled, but the raw decoded content remains visible and can be copied.