DOCUMENTATION

How SaferScans works.

A deep dive into the scanning pipeline, security engine, and privacy model that powers SaferScans.

The scanning pipeline

SaferScans uses jsQR, a pure-JavaScript QR code reading library, to decode QR codes entirely in your browser. No server, no cloud, no telemetry.

Camera mode

Captures frames from your device camera via the MediaDevices API and processes them through jsQR at ~30fps.

File upload

Draws the image onto an offscreen <canvas>, extracts pixel data, and passes it to jsQR for decoding.

Clipboard paste

Listens for paste events and processes clipboard images the same way as file uploads.

Camera → Canvas → ImageData → jsQR → decode → SafetyEngine → ResultCard

The Safety Preview Engine

Every decoded URL is passed through a multi-step analysis pipeline before being shown to the user. Nothing opens automatically.

  1. Scheme validation

    Blocks javascript:, data:, and vbscript: schemes outright. Flags non-HTTPS links as unencrypted. Warns on unusual schemes.

  2. Apex domain extraction

    Parses the hostname using the URL API, extracts the apex (eTLD+1) domain, and visually separates it from subdomains and path parameters in the Safety Card.

  3. Homograph detection

    Runs a regex check on the hostname for any non-ASCII (code point > 127) characters. Flags Cyrillic look-alikes that imitate Latin letters (e.g., а, е, о).

  4. Link shortener detection

    Checks the apex domain against a known list of 20+ link-shortening services (bit.ly, t.co, tinyurl.com, etc.) and warns the user if the true destination is hidden.

  5. IP address detection

    Flags URLs using a raw IPv4 address (e.g., http://192.168.1.1/login) — a common pattern in phishing attacks.

  6. Keyword heuristics

    Applies lightweight heuristics for suspicious keyword patterns (login, verify, account, etc.) combined with subdomain usage.

Structured data parsers

WIFI:

Wi-Fi Networks

Parses SSID, security type (WPA/WEP/nopass), password, and hidden flag. Password is hidden by default with a toggle reveal.

BEGIN:VCARD

Contact Cards

Extracts name (FN), phone (TEL), email (EMAIL), and organization (ORG). Offers a .vcf download button.

BEGIN:VEVENT

Calendar Events

Extracts event summary, start/end datetime, location, and description. Generates a .ics file for calendar apps.

tel:

Phone / SMS

Displays the number and requires explicit confirmation before triggering the tel: or sms: intent.

Privacy model

Camera frames are processed in-memory using the Canvas API. No frame is stored or transmitted.

Uploaded images are read into a Blob URL locally. No file is sent over the network.

Scan history is written only to window.localStorage in your browser. You can clear it at any time.

No analytics, no tracking pixels, no third-party scripts are loaded.

jsQR runs entirely as a browser-side ES module — no server call is made.

← Back to Scanner