See where it goes before you go.

A QR code doesn't tell you where it leads. SecureQR opens the link on our server instead of your phone, follows every redirect, and shows you a picture of the page at the end. Then you decide.

Coming soon for iPhone and Android

Check a link now

SecureQR

Point at a QR code. Nothing opens until you say so.

SecureQR

⚠

Check this oneEnds at a different site than it starts

🔒 pay-fee.parcel-track.example

Your parcel is on hold

Pay the €1.99 customs fee to release delivery.

Card number

Pay now

You would land on

pay-fee.parcel-track.example

HTTPS2 redirects

Open anyway

Don't open

Try it on a link

Paste any web address. We visit it for you and show what we find. Nothing opens in your browser.

How it works

Scan

Point the app at a QR code. It reads the code and stops there. Nothing is opened.

We go first

Our server opens the link in a locked-down browser, follows every redirect and takes a picture of the page it ends on.

You decide

You see the real destination, the picture and any warning signs. Open it, or don't.

What it looks for

Where it really ends. Short links and trackers hide the destination. You see every stop along the way and the final address, with the part that matters highlighted.
Known bad sites. Every address on the path is checked against the threat lists of Quad9 and Cloudflare.
Pages that ask for too much. A warning when the page wants a password or card details, is not encrypted, uses look-alike characters, or tries to download a file.
Hand-overs to other apps. You are told when a link tries to open another app instead of a web page.
Payment and other codes. Bank transfers, payment requests, Wi-Fi, contacts and sign-in codes are read on your phone and shown in plain words before anything happens. They are never sent to us.

A clean result means we found no warning signs. It is not a guarantee: a site can show our server something different from what it shows you.

Privacy

Only web links reach us. Everything else in a QR code stays on your phone.
No account, no tracking. The app works without signing in and has no advertising or analytics.
We keep very little. Page pictures are held in memory for 15 minutes and then gone. Our logs record the site names involved and the result, not the full link.
Your scan history stays on your phone. You can clear it at any time.
Blocklist checks send the site names (not the full link) to Quad9 and Cloudflare as ordinary DNS lookups.
One caution: checking a link means visiting it. A link that works only once, such as a one-time sign-in link, can be used up by the check.