SafeScan: QR & Phishing Check

Know before you open it.

Scan a QR code or link with your camera, from a photo, by pasting text, or by sharing it from another app, and SafeScan checks it before you open anything. Every result lands in one of four grades: Safe, Caution, Danger, or Not Verifiable. Addresses are checked against the unsafe-site list Google maintains in real time, and examined on the device for lookalike domains and suspicious address patterns. When there isn't enough evidence, SafeScan says so instead of guessing "safe." That honesty is what sets it apart.

■ Why "Not Verifiable" exists
Most checker apps only ever say safe or dangerous. In reality, "we don't know yet" is a common, honest answer. SafeScan never forces a safe verdict when the evidence is thin — it shows Not Verifiable instead. Calling something safe when it isn't is the one mistake this app is built to avoid.

■ Four ways in, no camera required
Point your camera at a QR code, pick a photo from your gallery, or paste a link copied from a text message or chat app. Camera access is optional — deny it and you can still scan through photos and paste.

■ Every verdict comes with a reason
SafeScan never just says "dangerous." It explains why: a lookalike domain that's one character off from the real one (checked by edit distance, common letter swaps, and punycode), a bare IP address behind http, a shortened link hiding its real destination, or wording that pushes for payment or identity verification.

■ Dangerous links get a second check
A Danger verdict requires a 3-second hold to proceed, then one more confirmation screen showing exactly where the link leads. Two separate steps stand between a rushed tap and an unsafe site.

■ What the check is based on
SafeScan asks Google Web Risk whether the address is on the unsafe-site list Google maintains in real time. Anything classified as phishing, malware or unwanted software is flagged as Danger straight away.

Alongside that, SafeScan references South Korea's KISA phishing report history (17,727 entries, as of 2023) as a supporting signal only. Because that data ages, a single match there is graded Caution, not Danger. Alongside it, on-device heuristics run at all times with no data required, plus lookalike-domain detection built for the region's most common phishing pattern: a domain spelled almost, but not quite, like the real one.

■ Messages worth double-checking
SafeScan flags wording commonly used in scam texts — fake delivery or customs notices, unpaid-bill or refund alerts, government subsidy notices, and identity-verification or account-suspension warnings. No single phrase decides a verdict; it's weighed together with the other signals.

■ QR codes aren't always links
SafeScan also reads Wi-Fi credentials, product barcodes, contact cards, and payment codes, and tells you which one you're looking at. It shows you the information — it doesn't join the Wi-Fi network or complete a payment on your behalf.

■ Your scan history stays on your device
Nothing is sent to a server. History is stored locally only, for the last 90 days or 500 entries, whichever comes first, then cleared automatically.

■ Good to have on hand for
· An unfamiliar link in a text or chat message
· A QR code you weren't expecting to scan
· A shortened URL that hides where it actually goes
· Public Wi-Fi QR codes or in-store payment QR codes

■ Please note
SafeScan is not antivirus software and does not remove malware already on your device. No checker can catch everything — Not Verifiable is how SafeScan admits that limit honestly instead of hiding it.

Free to use, supported by banner and interstitial ads. Your check history and photos are never uploaded. Checking a destination does mean the address itself leaves the device: to expand a short link, to compare it against the unsafe-site list Google maintains, and to ask how many people reported it (sent as a hash, not the address). The privacy policy lists exactly what goes where.