QR Safety Lab

Review local QR destination checks and reproducible export-readability tests, with public data, fixtures, methodology, and printable test sheets.

QR safety lab

Run predictable QR destination checks directly in your browser.

No destination is visited or fetched; the decoded content stays available for review and copying.

Release
2026-07-20-v1
Updated
Test cases
10

Summary

10/10 Pass

Clear

1

Clear indicates no matching structural warning in this release; it is not proof that a destination is safe.

Caution

5

Caution marks a destination structure that deserves deliberate review before opening.

Blocked

3

Blocked prevents direct opening. The raw decoded content remains visible and can be copied.

Test matrix

Test casesPayloadExpectedObservedWarning
Plain HTTPS destinationhttps-clearhttps://example.com/docsClearClearA conventional HTTPS URL with no release 1 structural warning.
Unencrypted HTTP destinationhttp-cautionhttp://example.com/docsCautionCautionHTTP does not provide the transport protection expected from HTTPS.
Shortened destination URLshortener-cautionhttps://bit.ly/CautionCautionA short URL hides the eventual destination behind a redirect service.
Punycode hostnamepunycode-cautionhttps://xn--e1afmkfd.invalid/CautionCautionPunycode can represent internationalized hostnames that need careful visual review.
Public IP address destinationpublic-ip-cautionhttps://203.0.113.10/loginCautionCautionA public IP address is less recognizable than a named domain.
Tracking-heavy destination URLtracking-cautionhttps://example.com/?utm_source=posterCautionCautionNumerous tracking parameters can obscure the meaningful destination path.
Embedded URL credentialscredentials-blockedhttps://user:password@example.invalid/BlockedBlockedUser credentials embedded in a URL can mislead readers about the true host.
Private-network destinationprivate-network-blockedhttps://localhost/adminBlockedBlockedPrivate or loopback network targets must not be opened directly.
Control character in destinationcontrol-character-blockedhttps://example.invalid/\nnextBlockedBlockedControl characters can change how a destination is displayed or interpreted.
Non-web intentnon-web-intentmailto:hello@example.comNot applicableNot applicableThis payload invokes a non-web scheme and is outside direct web navigation.

Methodology

  • Checks are deterministic and run locally in the browser.
  • No destination is visited, requested, or fetched during classification.
  • Release 1 tests destination structure only, not the content or reputation of a site.
  • Results are based on the decoded payload exactly as supplied to the checker.
Safety Lab methodology

Limitations

  • Clear is not proof of safety, legitimacy, or harmless content.
  • This release does not follow redirects, query APIs, or inspect destination pages.
  • A blocked result disables direct opening, while keeping raw decoded content visible and copyable.
  • Classification cannot replace user judgment or an organization’s security controls.

QR Safety Lab citation information

Research and data about local structural checks for QR destinations. Structural checks do not prove that a destination is safe.

Publisher
QR Code Crafter, Brand Aspect LtdCompany Registration Number: 05105266Legal information
Suggested citation
QR Code Crafter. “QR Safety Lab.” Release 2026-07-20-v1. Brand Aspect Ltd, July 20, 2026. https://qrcodecrafter.com/qr-code-safety-lab
Corrections
Report factual errors or problems reproducing this release. contact@qrcodecrafter.com

Release history

A dated record of the evidence included in each public dataset release.

Current release
2026-07-20-v1
First public release
Evidence in this release
Published 10 deterministic destination-structure fixtures with matching JSON, CSV, methodology and citation files.
Published:
Read the complete changelog

Compatibility scope

Export readability benchmark

This reproducible local benchmark generates QR files under controlled raster and vector conditions, then checks whether the site decoder recovers the exact payload.

2026-07-22-v1

A software fixture result is not a device, printer, ISO, or security certification. Test the final placement on real devices.

Exact decodes
19/21
Clean baselines
4/4
Stressed files
17
Published readability benchmark results
CaseFormatConditionDimensionsResult
png-clean-256pngClean export256 x 256Exact decode
jpg-clean-256jpgClean export256 x 256Exact decode
webp-clean-256webpClean export256 x 256Exact decode
svg-clean-256svgClean export256 x 256Exact decode
png-small-96pngSmall output96 x 96Exact decode
png-small-64pngSmall output64 x 64Exact decode
png-quiet-zone-2pngReduced quiet zone256 x 256Exact decode
png-quiet-zone-0pngNo quiet zone256 x 256Exact decode
png-low-contrastpngLow contrast256 x 256Exact decode
png-very-low-contrastpngLow contrast256 x 256Not decoded
jpg-quality-45jpgHeavy compression256 x 256Exact decode
jpg-quality-15jpgHeavy compression256 x 256Exact decode
png-blur-0-8pngBlurred image256 x 256Exact decode
png-blur-2-0pngBlurred image256 x 256Exact decode
png-rotate-8pngRotated image289 x 289Exact decode
png-rotate-18pngRotated image323 x 323Exact decode
png-center-obstruction-h-12pngCenter obstruction256 x 256Exact decode
png-center-obstruction-m-28pngCenter obstruction256 x 256Not decoded
png-dense-256pngDense payload256 x 256Exact decode
png-dense-128pngDense payload128 x 128Exact decode
png-wifi-192pngClean export192 x 192Exact decode

Frequently asked questions

Does this tool open the QR destination?
No. All checks are local and deterministic, and no destination is visited or fetched.
Does Clear mean the link is safe?
No. Clear only means release 1 found no matching structural warning.
What happens to blocked destinations?
Direct opening is disabled, but the raw decoded content remains visible and can be copied.