Inspiration QR codes are now everywhere—from restaurants to parking meters—but users have no visibility into where they actually lead. This makes them an easy target for phishing attacks, where a malicious QR code can silently redirect someone to fake login pages or scam sites. We wanted to build something that protects users at the exact moment of interaction, without requiring any cybersecurity knowledge.
What it does QR Shield lets users scan or upload a QR code and instantly analyzes the destination link for potential threats. It returns a real-time risk score (safe, suspicious, or dangerous) along with clear reasons behind the decision. Instead of blindly opening a link, users get an immediate safety warning that helps them decide whether to proceed.
How we built it We built a web application with a frontend camera scanner and upload option, and a backend risk analysis engine. The frontend uses a camera to detect QR codes from uploaded photos in real time and sends extracted URLs to the backend. The backend then runs a multi-layer security engine that analyzes URL structure, phishing patterns, and suspicious behaviors to generate a risk score and explanation.
Challenges we ran into One of the biggest challenges was detecting QR codes in different lighting conditions, angles, and visual distortions. On the backend, we initially relied on simple URL heuristics, but quickly realized we needed a more structured, multi-layer risk system to better simulate real-world phishing detection. Integrating real-time scanning with instant analysis also required careful optimization to keep the experience fast and seamless.
Accomplishments that we're proud of We successfully built a working real-time QR scanning system that feels like a native mobile security tool in a browser. We also designed a multi-layer risk engine that goes beyond basic keyword detection and provides explainable security decisions. Most importantly, we created a system that is usable by anyone, regardless of technical knowledge.
What we learned We learned how complex phishing detection actually is and how many signals are needed to approximate real-world security systems. We also gained experience in building real-time camera-based web applications and integrating frontend scanning with backend analysis pipelines. Most importantly, we learned how to design security tools that prioritize usability and accessibility over technical complexity.
What's next for QR Shield Next, we plan to enhance the risk engine with real-time threat intelligence APIs, improve detection of redirect chains, and add deeper page content analysis. We also want to expand QR Shield into a deployable safety tool for schools, workplaces, and public venues, as well as add accessibility features like voice feedback and multilingual explanations to make it even more inclusive.
