Same engine. Same answer. Every platform.
sniffQR is one detection engine on three surfaces: the Android app, a free browser extension, and the iPhone app that is next. Below is exactly what each one can do, and where a platform genuinely cannot do something, it says so instead of pretending.
What it actually does
Nothing reaches a threat-intelligence service until you turn one on
Every local check runs first, with zero service traffic. A link goes only to the services you enabled with your own key. With 'Check links automatically' on, a link that redirects shows you the chain first and you tick which URLs may be checked. Private codes (contact, Wi-Fi, calendar, crypto, 2FA) never leave the device by default.
Four verdicts, and one of them is 'Unknown'
'Safe', 'Potentially Suspicious', 'Likely Malicious', 'Unknown'. A 'Safe' verdict requires a service to have actually said so, every non-Safe verdict explains itself in plain English, and anything unverified reports 'Unknown' rather than a hopeful 'Safe'.
Redirect chain analysis, hop by hop
Tap 'Check where this goes' and sniffQR walks the chain, giving every stop its own verdict marker. Free follows one hop, Pro up to 15. Until you ask, or turn on 'Check links automatically' (free everywhere, off by default), the link's website is never contacted.
Look-alike characters, named and located
A Cyrillic а in "exаmple.com" is invisible to you and obvious to sniffQR. Confusables across five scripts, each finding named down to the official Unicode character, and a domain written honestly in one script never trips it.
Brand impersonation, four ways
Sixty high-value brands checked for digit substitution, confusables, typo-squats and subdomain impersonation. The same check runs on email and contact-card domains: locally, never resolved, never sent.
The rest of the local engine
Hidden characters stripped, counted and re-marked where they were. Double-extension file traps caught in both directions. Shell commands, the user@host trick, punycode, WebSockets and TLS downgrades, all flagged in plain English.
Eleven payload types with real actions
URLs, Wi-Fi, contacts, email, phone, SMS, geo, crypto, 2FA, calendar and plain text, each with its own result view and native actions on the apps. Even a bare wallet address with no URI scheme gets a proper crypto card.
The app protects itself too
'Lock on Exit' that fails closed, clipboard auto-clear for copied secrets, history encrypted at rest and excluded from cloud backup, certificate pinning on the built-in services, and no analytics, telemetry or ads of any kind.
History that is a visibility cap, not a shredder
Free shows your newest 5 scans; older ones are retained, not deleted, and reappear the moment you upgrade. Pro adds unlimited history, multi-select, export to four formats and 'Smart Rescan', which replays a past scan against fresher data. Deleting is free for everyone.
Offline threat scanning on your phone
Google Web Risk (Offline) matches hash prefixes right on your device. If a possible match is checked with Google, only a short piece of the link's fingerprint is sent, never the link itself. A possible match waits for you to check it with Google, or is checked automatically if you choose, and an unchecked one never reads 'Safe'. You start the first download; after that the list updates itself while the app is open and online.
VirusTotal by fingerprint only
Only a SHA-256 fingerprint is ever sent. Never the URL, and never a submission. VirusTotal needs a Premium API key. When VirusTotal has no report for a hash, sniffQR says 'Unknown' rather than inventing a verdict.
Your own threat feeds
Point sniffQR at up to 8 HTTPS endpoints of your own, 10 providers in total. Each returns a verdict with reasons for the scanned payload and every redirect hop.
The details
A rotating sample of the smaller decisions. Pro items are labeled; everything else is free.
Up to 4 codes at once
Free scans the code nearest your tap. Pro tracks up to four at once: the four nearest the middle of the frame, re-picked as you move the camera, so you aim rather than hunt. Tap the one you want.
Scan from a photo
Pick a saved image and scan the codes inside it. On Android this uses the system Photo Picker, so it needs no media permission at all. Pro.
Copied links are free
A link or text on your clipboard is checked on the free tier. Images are Pro.
Bare crypto addresses
A naked bc1… or 0x… with no URI scheme still renders a crypto card with 'Open in Wallet'. An address containing a look-alike character is not a valid address, so it falls through to text, where homoglyph scanning still catches the scam.
Pinch to zoom
Reach a small or distant code without walking to it. Pro.
Smart Rescan
Replays the selection you actually made, not everything and not just the original, so a rescan answers the same question with newer data. If your service settings have changed since, the caption changes too. Pro.
Crypto clipboard check
Clipboard-hijacking malware swaps a wallet address after you copy it. sniffQR lets you check the copied address against the one you scanned. Pro on the apps; the browser clipboard is not the OS clipboard, so the extension cannot.
Export your history
TXT, CSV, JSON or XML, with a warning that exports can contain passwords and 2FA secrets. Pro.
Share an image in
Send an image from any app into sniffQR and it runs the same pipeline, including the consent gate on a fresh install. Pro. There is no text share target. Images only.
Siri and App Shortcuts
Five App Intents on iPhone, free, including a headless Check URL Safety intent that returns a verdict without opening the app. Android gets four launcher shortcuts instead.
Snip the screen
Drag a box around a QR code anywhere on the page. If your selection catches more than one code, the extension highlights the one nearest the center and waits for you to tap it, the same "pick the one you meant" step as the camera (Chromium browsers). It also takes an uploaded or copied image. No camera.
Security glossary
Over 50 terms explained in plain language, searchable, with reference links. Free, in both apps and the extension.
Secrets stay masked
Wi-Fi passwords and 2FA secrets are masked with a reveal toggle, and revealing a 2FA secret warns you about shoulder-surfing first.
Only http and https open directly
Any other scheme goes through the share sheet instead, so an exotic scheme in a QR code can never be launched verbatim by one tap.
Dialed numbers are sanitized
A tel: payload can hide a USSD or MMI code that acts the instant it reaches the dialer. Both apps strip those and ask you to confirm. Neither ever places a call itself: the number is handed to your dialer pre-filled, so the last tap is always yours.
Quota guard
A client-side limiter caps lookups at 3,000 a day to protect your Google Cloud quota, and VirusTotal calls are rate-limited too.
Every capability, every platform
Free means it works with no purchase. Pro means the one-time upgrade. A dash means the capability does not apply to that platform.
| Features | Web extension | Android | iPhone |
|---|---|---|---|
| Local detection: no key, no account, no network | |||
| Look-alike characters, with script and Unicode character named | Included | Included | Included |
| Compatibility fold (full-width, mathematical alphanumerics, ligatures) | Included | Included | Included |
| Whole-script spoof detection, gated on brand resemblance | Included | Included | Included |
| Brand impersonation: four detection passes | Included | Included | Included |
| Leetspeak substitution (brand-gated) | Included | Included | Included |
| Hidden characters stripped, counted and re-marked | Included | Included | Included |
| Harmful file types (double-extension aware) | Included | Included | Included |
| Shell and terminal command patterns | Included | Included | Included |
| Misleading URL format (user@host) | Included | Included | Included |
| Punycode decoded and re-scanned | Included | Included | Included |
| WebSocket / CSWSH payloads | Included | Included | Included |
| Brand check on email and contact-card domains (local only) | Included | Included | Included |
| Redirect analysis | |||
| Reveal the real destination | Free, on click | Free, 1 hop | Free, 1 hop |
| Check links automatically (off by default) | Free | Free | Free |
| HTTPS → HTTP downgrade (once a link is checked) | Included | Included | Included |
| Per-hop detail for the whole chain | Entry + final only | Pro | Pro |
| Configurable depth, 1 to 15 hops (default 5) | Not included | Pro | Pro |
| Block insecure HTTPS → HTTP redirects | Best effort: only a chain that ends on http | Pro, on by default | Pro, on by default |
| Private / loopback address protection (SSRF) | Partial: the link itself, not its redirects | Included | Included |
| Credentialed redirect recovered and shown | Not included | Included | Included |
| Per-hop verdict marker on every row | Entry + final | Included | Included |
| Getting content in | |||
| Live camera scan | Not included | Free | Free |
| Up to 4 QR codes detected at once | Not included | Pro | Pro |
| Tap to choose among detected codes | Not included | Pro | Pro |
| Tap-to-focus | Not included | Free | Free |
| Pinch-to-zoom | Not included | Pro | Pro |
| Scan from your photo library | Not included | Pro | Pro |
| Upload an image file | Free | Not included | Not included |
| Drag-to-snip a region of the screen | Free | Not included | Not included |
| A copied link or copied text | Free | Free | Free |
| A copied image | Free | Pro | Pro |
| Share an image into the app | Not included | Pro | Pro |
| Barcode formats | QR only | QR only | QR only |
| Results and actions | |||
| A bespoke result view for all eleven payload types | Included | Included | Included |
| The original value re-shown with confusables highlighted inline | Included | Included | Included |
| Secrets masked, with a reveal toggle | Included | Included | Included |
| Connect to Wi-Fi | Not included | Included | Included |
| Add to Contacts / Add to Calendar | Not included | Included | Included |
| Call / SMS / Email | Handed to your OS via tel:, sms:, mailto: | Included | Included |
| Open in Maps | Included | Included | Included |
| Open in Wallet, including bare crypto addresses | Included | Included | Included |
| Open in Authenticator (2FA) | Not included | Included | Included |
| Search Web (plain text) | Included | Included | Included |
| Isolated in-app preview | New tab, not isolated | Ephemeral Chrome tab, or sniffQR's own browser | In-app Safari view |
| Crypto clipboard-hijack check | Not included | Pro | Pro |
| Confirmation before opening anything that is not 'Safe' | Included | Included | Included |
| Privacy and app security | |||
| Blocking consent gate on first run | Read-only disclaimer on the Info page | Included | Included |
| 'Lock on Exit' (biometric or device credential, fails closed) | Not included | Free | Free |
| Hidden from the task switcher when backgrounded | Not included | App switcher preview hidden (Android 13+) | Blur overlay |
| Clipboard auto-clear for copied secrets | Not included | Free | Free |
| Scan history encrypted at rest | Not included | AES-256-GCM per field | AES-256-GCM per field |
| API keys in OS secure storage | Local only, never synced | Encrypted prefs + Keystore | Keychain |
| Excluded from cloud backup and device transfer | Not included | Included | Included |
| Root / jailbreak warning (non-blocking) | Not included | Included | Included |
| Analytics, telemetry or advertising SDKs | None | None | None |
| History | |||
| Persistent scan history | By design: none | Free (newest 5) | Free (newest 5) |
| Older scans retained and restored on upgrade | Not included | Included | Included |
| Unlimited history | Not included | Pro | Pro |
| Search, including script and Unicode character names | Not included | Included | Included |
| Delete a scan record | Not included | Free | Free |
| Clear All history in one action | Not included | Free | Free |
| Multi-select edit and share | Not included | Pro | Pro |
| Export to TXT, CSV, JSON, XML | Not included | Pro | Pro |
| Share a single scan result | Not included | Free | Free |
| Smart Rescan (replay a past scan against fresher data) | Not included | Pro | Pro |
| Safety services: you bring the key | |||
| Google Web Risk (online) | Free | Free | Free |
| Google Web Risk (Offline) | Not included | Pro | Pro |
| VirusTotal (SHA-256 fingerprint only, never the URL) * | Not included | Pro | Pro |
| Custom threat feeds (up to 8) | Not included | Pro | Pro |
| Providers in total | 1 | 10 | 10 |
| Key verification button | Included | Included | Included |
| Daily quota guard (3,000 lookups) | Included | Included | Included |
| Certificate pinning on the built-in services | Browser TLS | Included | Included |
| Contact, Wi-Fi, calendar, crypto and 2FA codes: no network by default, never to a custom feed | Included | Included | Included |
| Reference and integration | |||
| Security glossary, 50+ terms | Included | Included | Included |
| API key setup guides | Options page | Included | Included |
| Deep links into the app | Not included | Included | Included |
| Launcher / home-screen shortcuts | Not included | Included | Included |
| Siri and App Shortcuts (5 intents, free) | Not included | Not included | Included |
| Browser toolbar popup | Included | Not included | Not included |
| Privacy Policy and Terms in-product | Included | Included | Included |
| Requirements | |||
| Minimum OS | Chrome/Edge 116+ Firefox 140+ | Android 12 | iOS 17 |
| Devices | Desktop browsers | Phone | iPhone and iPad |
| Language | English | English | English |
| Price | Free, no purchase | Free + one-time Pro | Free + one-time Pro |
Local detection: no key, no account, no network
ExtAndroidiPhoneRedirect analysis
ExtAndroidiPhoneGetting content in
ExtAndroidiPhoneResults and actions
ExtAndroidiPhonePrivacy and app security
ExtAndroidiPhoneHistory
ExtAndroidiPhoneSafety services: you bring the key
ExtAndroidiPhoneReference and integration
ExtAndroidiPhoneRequirements
ExtAndroidiPhoneEvery threat-intelligence service is optional and uses your own API key: nothing is enabled by default. Google Web Risk needs a Google Cloud account and is in the free tier on every platform. Google sets Web Risk pricing and can change it: cloud.google.com/web-risk/pricing. Google Web Risk (Offline) syncs a local hash database to your device and then checks links on your phone. If a possible match is checked with Google, only a short piece of the link's fingerprint is sent, never the link itself. List updates are free. Checking a match with Google is not free. Use a different billing account than your online key, or online checks stop being free too. Pricing: cloud.google.com/web-risk/pricing. * VirusTotal requires your own VirusTotal Premium key, per VirusTotal's terms, and is checked with a SHA-256 fingerprint of the URL. The URL itself is never sent and nothing is ever submitted. Custom threat feeds point at your own HTTPS endpoint. Setup guides for all of them are built into the apps and the extension's options page.
One difference is worth calling out because it is a browser limitation rather than a product decision: an extension can only see the entry and final URL of a redirect chain, never the hops in between. The extension says so on screen rather than claiming a number it cannot know.
Ready to scan safely?
The browser extension is out now and free in its entirety, and the apps add the camera, offline scanning, VirusTotal, custom feeds, history and everything else Pro unlocks for one payment, never a subscription.
Android is out now, iPhone is next. Same engine, same verdicts.
Free browser extension
Free forever, with the same detection engine as the apps, running in your browser.