QR Code Scanner

QR codes are a phishing vector by design

The property that makes a QR code convenient is exactly the property that makes it dangerous: a human being cannot read it. When you click a link in an email you can at least glance at the URL and notice that it does not go where it claims. A QR code offers no such opportunity — you are asked to trust a pattern of squares and find out where it leads only after you have arrived. Attackers have taken full advantage. Fraudulent QR stickers have been pasted over legitimate ones on parking meters and restaurant tables, and codes in phishing emails route recipients to convincing credential-harvesting pages. The practice has acquired its own name, quishing, and it works precisely because the usual defence — look before you click — is unavailable. Decoding the code to text first restores it.

Why a QR code still scans when it is damaged

QR codes carry Reed-Solomon error correction, the same family of mathematics that lets a scratched CD play and a distant spacecraft transmit intelligible data. Depending on the correction level chosen when the code is generated, somewhere between 7 and 30 percent of the code can be obliterated and the original data still reconstructed perfectly. This is not merely robustness for its own sake — it is why companies can drop a logo into the middle of a QR code and have it still work, and why a code printed on a crumpled receipt or partially covered by a coffee ring scans without complaint. The three large squares in the corners are finder patterns, letting the scanner locate the code and work out its orientation, which is why a QR code can be read upside down or at an angle.