sniffQR: Scan Smart, Stay Safe by Apogaeum Labs

sniffQR shows you what is really inside a QR code before you act on it, and tells you honestly when it cannot be sure.

SNIP IT, UPLOAD IT, OR PASTE IT
Drag a box around any QR code on a page. If your selection catches more than one code, sniffQR highlights the one nearest the center and waits for your click. It also takes an uploaded image, a copied image, or a copied link or text. No camera needed.

NOTHING IS CHECKED UNTIL YOU SAY SO
Every local check runs first, with zero traffic to any threat service. A URL goes to Google Web Risk only after you turn it on with your own API key, and then only the link you scanned, plus where it ends up once you check that. With it off, nothing leaves your browser until you click 'Check where this goes' or turn on 'Check links automatically'.

PRIVATE BY DESIGN
No accounts, no servers, no analytics, no ads. The extension keeps no history at all: one result, read and gone. Your API key stays in your browser's local storage and is never synced by us or sent to us.

THE LOCAL DETECTION ENGINE RUNS RIGHT HERE
No key, no account, no network needed. sniffQR reads the payload and its URLs for look-alike characters, brand impersonation, hidden characters, harmful file types, shell commands and the user@host trick, among others. Then it names what it found, in plain English.

SOME OF THOSE LETTERS ARE LYING TO YOU
A Cyrillic "а" looks exactly like a Latin "a". sniffQR detects look-alike characters across five scripts, names each finding down to the exact Unicode character, and shows you the real punycode address next to what you saw.

IT WOULD RATHER SAY IT DOES NOT KNOW
Four verdicts: 'Safe', 'Potentially Suspicious', 'Likely Malicious', and 'Unknown'. A 'Safe' verdict requires a threat-intelligence service to have actually said so. No check means 'Unknown', never 'Safe'. Every verdict other than 'Safe' explains itself in plain English.

REDIRECTS, HONESTLY
sniffQR checks where a link goes only when you click 'Check where this goes', or after you turn on 'Check links automatically' in the options page (it starts off). A browser shows an extension only the entry and final URL of a chain, so sniffQR says "via redirect chain" rather than claiming hop counts it cannot know. The sniffQR apps show every hop.

THREAT INTELLIGENCE, WITH YOUR KEY
Google Web Risk works with your own API key, off by default. VirusTotal, custom threat feeds and the offline database are app features: a browser extension cannot hold an offline threat database, and it says so instead of pretending.

ELEVEN PAYLOAD TYPES
URLs, Wi-Fi, contacts, email, phone, SMS, geo, crypto, 2FA, calendar and plain text, each with its own result card, including 'Open in Wallet' for bare crypto addresses. The extension does what a browser can do and does not pretend to do the rest; the apps add the native actions.

THE APPS
The sniffQR apps add the camera, scan history, offline scanning, VirusTotal (Premium API key required), custom threat feeds and more, for one payment, never a subscription. Android is out now on Google Play; iPhone is next.

Screenshots show example scans. Service results in them are simulated.

Requires Firefox 140 or newer. Also available for Chrome and Edge.