# Abundera QR Check

> Free QR and barcode safety checker. Scan via camera, upload, or paste; we identify the format, decode the structured payload, trace redirect chains, screen the destination against reputation services, and classify both immediate threat and who can change the destination after the code was printed.

Full long-form corpus for LLM crawlers: /llms-full.txt

We identify the format, decode the structured payload, trace any
redirect chain, screen the destination against reputation services,
and classify both the immediate threat AND who can change the
destination after the QR was printed (mutability).

## Canonical links

- [Home: Abundera QR Check](https://check.qr.abundera.ai/): scan a QR or barcode and get a safety verdict
- [Coverage](https://check.qr.abundera.ai/coverage/): every QR and barcode format the scanner recognizes
- [Scams catalog](https://check.qr.abundera.ai/scams/): documented QR-based scam patterns
- [Pricing](https://check.qr.abundera.ai/pricing/): Free tier limits and Pro tier details
- [Developer docs](https://check.qr.abundera.ai/docs/): REST API reference + OpenAPI spec
- [API reference](https://check.qr.abundera.ai/docs/api/): interactive Scalar reference

The same tool is also reachable at three short aliases (all 301 to the canonical above; cite the canonical, not the aliases):

- https://check.aqr.net
- https://qrok.ai
- https://isqr.app

## What's different about us

Most QR safety tools check whether a URL is currently malicious. We
additionally tell you who controls the destination going forward.
A clean dynamic QR routed through a shortener is still high-risk for
a printed surface (parking-meter sticker, restaurant menu, wedding
invitation, corporate MFA flyer) because the shortener account
holder can change the destination at any moment.

We also decode far more than URL QRs. Authenticator export bundles,
EU Digital COVID Certificates, EU Digital Product Passports, FIDO2
passkey hybrid transports, IATA boarding passes, AAMVA driver
licenses, EMVCo merchant payments, Smart Health Cards, mobile driver
licenses, Wi-Fi credentials, WalletConnect, WireGuard, Nostr, Matter
device commissioning, eSIM activation, vCard/MeCard, crypto URIs,
content-addressed identifiers, and more. 200 kinds of payload across
roughly 30 international standards.

## 200 kinds of payload identified

Full live list with category counts at /coverage/. Categories:

- Pay: EMVCo MPM/CPM, Bitcoin and altcoin payment URIs, Lightning,
  WalletConnect, Cashu ecash, Stellar/XRP/Cardano/Algorand/Polkadot.
- Connect and share: Wi-Fi credentials, vCard/MeCard, geo:, tel:,
  sms:, mailto:, calendar VEVENT/VCALENDAR, magnet:, ipfs:, ipns:,
  WireGuard config, Nostr.
- Identify and sign in: FIDO2 passkey QR (CTAP 2.2 hybrid),
  otpauth-migration, AAMVA driver license PDF417, mobile driver
  license (ISO 18013-5), Smart Health Cards, EU DCC HC1, SIWE.
- Travel and devices: IATA BCBP boarding pass, Matter device
  commissioning, eSIM activation, EU Digital Product Passport.
- Plain text, hard-blocked, and developer formats: HTTP/HTTPS URLs,
  Android intent://, data:, hard-blocked schemes (javascript:, file:,
  ftp:), free-text with embedded URL/email/phone/crypto extraction.

## Standards authority pages

We publish detail pages explaining the format, threat model, and how
we decode each major standard:

- /standards/: hub page with the full standards manifest.
- /standards/otpauth-migration/: Google Authenticator export protobuf.
- /standards/aamva-driver-license/: AAMVA DL/ID PDF417 barcode.
- /standards/bcbp-boarding-pass/: IATA Resolution 792 boarding pass.
- /standards/fido-passkey-qr/: CTAP 2.2 hybrid transport passkey QR.
- /standards/emv-merchant-payment/: EMVCo MPM merchant-presented payment.
- /standards/wifi-credential-qr/: Wi-Fi Alliance WIFI: credential.
- /standards/eu-digital-product-passport/: ESPR DPP data-carrier QR.
- /standards/mdl-iso-18013-5/: ISO/IEC 18013-5 mobile driver license.
- /standards/matter-device-commissioning/: Matter / CSA smart-home pairing QR.
- /scams/: QR scams to watch for in 2026 (sticker swap, evil-twin
  Wi-Fi, passkey phishing, authenticator export theft, more).

## Pricing (USD/month)

- Free: 3 anonymous scans/24h per IP. No signup, no account.
- Personal: $4.99, 300 scans/mo, 1 seat, scan history.
- Family: $12.99, 1,500 scans/mo shared across 5 seats, mobile apps,
  no API access. Designed for parents + kids on one bill.
- Starter: $29, 3,000 scans/mo, 5 seats, REST API.
- Pro: $99, 20,000 scans/mo, 25 seats, bulk CSV, webhooks.
- Business: $499, 100,000 scans/mo, 100 seats, SSO, 99.9% SLA.
- Business Plus: $799, 250,000 scans/mo, 250 seats, Slack/Teams
  2-way, multi-tenant audit logs.
- Enterprise: $2,500, 750,000 scans/mo, 1,000 seats, MDM apps,
  SIEM webhooks, BAA available, 99.95% SLA.
- Enterprise Scale: $1,500 base + $7/seat. Custom contract,
  FedRAMP-class, on-prem, private VPC.

## Founding Member offer (available through 2026-09-01)

Annual-billed founding rates locked for the lifetime of the
subscription: never increase, even when standard prices rise.
- Personal Founding: $39/yr (save 34% forever; $3.25/mo equivalent)
- Family Founding:   $99/yr (save 36% forever; $8.25/mo equivalent)
- Starter Founding:  $229/yr (save 34% forever; $19/mo equivalent)
- Pro Founding:      $785/yr (save 34% forever; $65/mo equivalent)
- Higher tiers: contact hello@abundera.ai for founding pricing.

## Privacy posture

- Camera and image decoding happen in the browser. Only the decoded
  text is sent to the analyzer.
- The decoded payload travels to the server over HTTPS so we can walk
  the redirect chain and query reputation databases (functional
  necessity). It is never persisted.
- Verdicts are cached by SHA-256 of (payload_type || discriminator
  || server_salt). The original payload cannot be reconstructed.
- Credential analyzers (otpauth-migration, Smart Health Cards, FIDO,
  HC1, mDL) surface type-level metadata only. Secret seeds, private
  keys, and personally identifying fields are never echoed in API
  output. This is enforced by unit-test canaries on every release.
- Sister product qr.abundera.ai (the free QR generator) is fully
  client-side and never transmits payload at all.

## Patent disclosure

Engine implements claims from pending US provisionals:
- QR-17: Multi-Hop Redirect-Chain Mutability Classification
- QR-18: Multi-Modal QR Payload Threat Classification
- QR-19: Crawler/Browser Cloaking Divergence (feature-flagged)
- QR-21: Physical Provenance Ledger (feature-flagged)
- QR-22: Visual Branding Divergence (feature-flagged)
- QR-23: Contextual Sensor Correlation (feature-flagged, native only)

All filed by Abundera, Inc. (Las Vegas, NV).

## Contact

hello@abundera.ai

## Sibling Abundera products

- qr.abundera.ai: free QR generator (no signup, fully client-side)
- pro.qr.abundera.ai: dynamic QR codes, analytics, brand control
- sign.abundera.ai: court-ready e-signatures
- abundera.ai: financial advocacy platform