QRavn – QR code scam check

SECURITY PROFESSIONALS DON'T SCAN QR CODES WITH THE CAMERA APP Every official guide on QR codes gives the same advice: read the web address before you open it. If you cannot see the address, do not proceed. But the advice stops there. And even once you can finally see the address — do you know what you are looking for? That is the job QRavn does. It reads the code and runs 49 checks on it before anything opens. You are not just handed the link. You are handed the answer. 49 CHECKS, ACROSS THREE AREAS 26 checks on the address itself. Whether the real domain sits at the end instead of the start, so that bankid.no.verify-login.example is not BankID at all. Whether one letter has been swapped for one from another alphabet, so the name only looks right. Whether invisible characters are hidden inside the address. Whether a username and password have been placed in front of the domain. Whether the address is a raw number instead of a name. 16 checks on what the code actually contains. A QR code is not always a link. It can be a Wi-Fi network with no password, a pre-written SMS to a premium-rate number, a crypto wallet, or a key to your two-factor login. 7 checks on where the link forwards you. Shortened links that point at further shortened links. Chains that hop from domain to domain. Redirects that drop from encrypted to unencrypted along the way. You do not need to know a single one of them. That is the entire point. THIS IS ALREADY HAPPENING In Kristiansand, Norway, more than 20 fake QR stickers were found on parking meters. They were stuck straight over the real ones, carrying the name of a parking company people trust. In second-hand marketplaces, buyers are sent a QR code to "pay with", and the card is charged far more than the asking price. One person lost 90,000 kroner. Police and banks have warned about both. A sticker costs a scammer almost nothing to print. QRavn INVESTIGATES THE CODE INSTEAD OF OPENING IT Point the camera at the code. Nothing opens. The 49 checks run immediately, on your phone, and you get a verdict with the reasoning beside it: what was found, where in the address it sits, and what it means. Then you decide, holding what you should have had all along. "AREN'T QR SCANNER APPS THE PROBLEM?" Usually they are, and the warnings are fair. Most of them are advertising businesses, and what you scan is the product. QRavn holds no INTERNET permission at all. Not "we promise not to" — the permission simply is not there, so it is Android itself that refuses to let the app reach the network. It cannot upload what you scanned, because it cannot upload anything. No account. No analytics. No ads. No scan history. It works in airplane mode. WHAT IT SAYS, AND WHAT IT WILL NOT SAY QRavn never tells you a link is safe. No app can promise that, however confidently it is phrased. It tells you what it found, and what it could not determine: • the address imitates a name you know • characters from another alphabet are mixed in, so letters look alike • the link is shortened, so the destination is hidden • the page asks for a login or for BankID • the address is not encrypted When it finds nothing, that is exactly what it says: "none of the 49 checks found anything", not "safe". That difference is the whole point of the app. BUILT FOR ANDROID • Share a link to QRavn from any app • Quick Settings tile: put the scanner in the panel you pull down • Shortcut: long-press the icon and go straight to scanning • Pick an image from your gallery instead of scanning • Torch for codes in poor light • Follows the system light and dark theme • Norwegian Bokmål, Norwegian Nynorsk and English PRIVACY We collect no personal data. We cannot: the app has no way to send anything. Full policy: https://qravn.isainative.dev/privacy 49 checks first. Then you decide. QRavn is made in Norway, for people in Norway. You don't open it alone.