Is QR Code Reader safe?
We analyzed QR Code Reader version 1.4.1's actual code and gave it a 76/100 trust score. This is a generally purpose-aligned QR scanner with moderate…
Bottom line
This is a generally purpose-aligned QR scanner with moderate privacy and cleanup concerns.
What it can access
Its access fits QR scanning but can capture visible pages, camera video, or shared screens after use or approval.[Q1][Q3][Q5][Q13]
Security weaknesses
Camera or screen-sharing sessions may remain active when switching modes, creating a privacy and resource risk.[Q5][Q8]
Signs of misuse
No misuse of scanned content was found, but the service collects account data and a persistent visitor ID for billing and tracking.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab, storage, offscreen, and access to platform.scanqr.tools. It has no general host access or page access, but activeTab lets it screenshot the visible page when the user opens the popup.
Declares storage, activeTab, offscreen, and only the paywall service as a host permission. — manifest.json:permissions and host_permissions
Calls chrome.tabs.captureVisibleTab to obtain a PNG of the visible tab. — assets/chunk-08c7c5ea.js:h5 function C
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts and requests no scripting permission. — manifest.json:top-level fields
Renders decoded URLs as target=_blank anchors inside the popup. — assets/chunk-08c7c5ea.js:h5 result rendering
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can process a screenshot of the visible tab, user-uploaded or pasted images, live camera frames, shared-screen frames, and the decoded text or URL contained in a QR code. It cannot directly read page page, cookies, or browsing history.
Implements current-tab capture, image upload/paste, camera scanning, and display capture. — assets/chunk-08c7c5ea.js:h5 C, m, N, and j
No cookies, history, tabs, or all-sites permission is declared. — manifest.json:permissions
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores install date, last-selected scan mode and camera, rating state, a persistent paywall visitor ID, cached pricing/account data, and—if the user signs in—access/refresh tokens and account state. It does not store scanned images or decoded results.
Stores installDate in chrome.storage.sync. — assets/chunk-1492b33a.js:onInstalled
Stores selected tab/mode and camera in local storage. — assets/chunk-08c7c5ea.js:h5 effects
Defines persistent visitor, auth session, anonymous refresh token, bootstrap, balance, and checkout cache keys. — assets/chunk-ea99d32f.js:V storage keys and AuthClient
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture camera and shared-screen video after the user selects those modes and accepts browser permission prompts. Camera mode opens an extra getUserMedia stream without stopping it, and switching modes does not reliably close active camera or display streams.
Calls getUserMedia once and discards the stream, then starts QrScanner, which obtains a second stream. — assets/chunk-08c7c5ea.js:h5 function N
Calls getDisplayMedia and stops its track only after a decode result or caught scan failure. — assets/chunk-08c7c5ea.js:h5 function j
Starts the newly selected mode without a cleanup function that stops the previous scanner or media track. — assets/chunk-08c7c5ea.js:mode-change effect
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends paywall, anonymous-visitor, account, checkout, subscription, and support data to platform.scanqr.tools. I found no code sending screenshots, uploaded images, camera/screen frames, clipboard images, or decoded QR values to that service.
Uses paywall ID 797 at https://platform.scanqr.tools and posts paywall events with visitor/user identifiers. — assets/chunk-ea99d32f.js:paywall constants and tracker
Passes pixels into packaged QR decoders and calls the paywall open method without supplying scan results. — assets/chunk-08c7c5ea.js:h5 scan functions
Relays authentication, billing, tracker, support, and staged support-file operations to the remote SDK. — assets/offscreen-17781bc6.js:T transport handlers
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All extension script entry points are packaged files. — manifest.json:background and action
Parses remote API data into fixed packaged billing and UI flows. — assets/chunk-ea99d32f.js:BillingClient and PaywallUI
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Opening the popup automatically scans the visible tab if that was the saved/default mode; camera and screen sharing require selecting their tabs and granting permission. Successful scans automatically open the paywall, and media capture is not reliably cleaned up when modes change.
Defaults to current-tab mode and calls capture logic when the mode becomes active. — assets/chunk-08c7c5ea.js:g5 and h5 mode effect
Calls the paywall open method after any non-empty scan result when installDate exists. — assets/chunk-08c7c5ea.js:h5 function f
No mode-transition cleanup closes previous camera or screen-share tracks. — assets/chunk-08c7c5ea.js:h5 media functions
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, privacy, management, declarativeNetRequest, or webRequest permission. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main popup and billing SDK are large minified bundles without source maps, but entry points, remote services, browser services, scan-result flow, and media lifecycle can still be traced. Many smaller chunks contain translations rather than hidden execution paths.
A roughly 459 KB minified bundle contains the popup UI, QR libraries, and capture flow. — assets/chunk-08c7c5ea.js:entire file
A roughly 224 KB minified billing/auth SDK contains the network and storage logic. — assets/chunk-ea99d32f.js:entire file
No source maps are included. — inventory.json:files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no eval call, new Function construction, or string timer callback. — assets/*.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Accepts updated URLs only when their hostname matches platform.scanqr.tools and their path is a fixed callback or checkout result. — assets/chunk-1492b33a.js:T and v
No history, webNavigation, tabs, or general host permission is declared. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
The paywall SDK creates and stores a random persistent visitor ID and may associate it with an anonymous or signed-in user ID. It uses those identifiers in billing services headers and paywall event data.
Generates a UUID-like value and stores it under pw-visitor-id. — assets/chunk-ea99d32f.js:V, ei, and ut
Sends visitor_id and optional user_id with paywall events to the platform. — assets/chunk-ea99d32f.js:Ar tracker
Does it send cookies, session details, authentication data, or page contents elsewhere?
If the user creates or signs into a paywall account, email/password or OAuth data and access/refresh tokens are handled by platform.scanqr.tools and persisted locally for the session. The extension does not read unrelated website cookies, passwords, or sessions.
Posts chosen login credentials or OAuth codes to the platform's fixed authentication endpoints. — assets/chunk-ea99d32f.js:AuthClient email/OAuth methods
Stores access token, refresh token, expiry, user, and anonymous refresh token in extension/offscreen storage. — assets/chunk-ea99d32f.js:AuthClient storage
No cookies permission is declared. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
It reads an image from the clipboard only when the user pastes into the popup while using current-tab or image mode. It does not install a keyboard logger or silently read clipboard contents, but camera/screen frames are captured after explicit permission.
Handles a paste event, accepts only the first image item, and decodes it locally. — assets/chunk-08c7c5ea.js:h5 paste effect
Processes camera and shared-screen frames after those modes are selected. — assets/chunk-08c7c5ea.js:h5 N and j
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Loads remote bootstrap, experiment, pricing, trial, user, checkout, and balance data. — assets/chunk-ea99d32f.js:BillingClient bootstrap and PaywallUI
Accepts only same-platform callback paths and opens checkoutUrl returned by the packaged auth flow. — assets/chunk-1492b33a.js:OAuth/checkout callback handling
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content scripts or site-modification permission exists. — manifest.json:top-level fields
Displays decoded URLs exactly as local result links without rewriting them. — assets/chunk-08c7c5ea.js:h5 result rendering
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads, or proxy permission is declared. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
No localhost, loopback, native-host, or executable-launch endpoint was found. — assets/*.js:endpoint review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Decodes image matrices into strings and renders them as text or explicit anchors. — assets/chunk-08c7c5ea.js:h5 P and result rendering
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration exists. — manifest.json:top-level fields
Relays only extension runtime connections with the SDK's fixed channel name. — assets/chunk-1492b33a.js:k and _
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Switches among current tab, image, camera, and screen-share flows and hides account UI in incognito. — assets/chunk-08c7c5ea.js:h5 and g5
Uses remote trial, entitlement, pricing, and experiment state to choose billing UI. — assets/chunk-ea99d32f.js:PaywallUI
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CPU-intensive loops implement grayscale conversion, QR detection, and decoding of user-selected frames. — assets/chunk-08c7c5ea.js:QR decoder and h5
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or webpage scripting permission exists. — manifest.json:top-level fields
Form handling is confined to packaged account, payment, and support interfaces. — assets/chunk-ea99d32f.js:auth and support UI