English · Türkçe
QuishScope is an offline-first QR payload inspection tool for incident responders, security teams, and cautious humans. It decodes local QR images, exposes the real payload, and explains phishing signals without opening the destination or making a network request.
A risk score is a triage signal, not proof that a payload is malicious or safe.
QR codes hide their destination until a reader interprets them. QuishScope puts a static, inspectable layer between the image and the click:
- decodes one or many QR codes from PNG, JPEG, WebP, GIF, BMP, and TIFF images;
- classifies URL, email, Wi-Fi, and plain-text payloads;
- detects IDN/Punycode and mixed-script hosts, raw IPs, userinfo tricks, unusual ports, URL shorteners, suspicious lure terms, nested redirects, and layered encoding;
- redacts Wi-Fi passwords and defangs links in terminal output;
- returns deterministic human or JSON reports with CI-friendly exit codes;
- caps file size, image pixels, payload length, and nested decoding depth.
The GitHub Pages app accepts a QR image by file picker or drag and drop. Decoding and inspection both happen inside the browser: the selected image and decoded payload are never uploaded, and the destination is never opened. The browser decoder is a locally vendored copy of jsQR, so the feature does not depend on a third-party CDN at runtime. The web playground reads one QR per image, limits images to 10 MB, and demonstrates a compact rule subset; use the CLI for batch and full analysis.
python -m pip install "git+https://github.com/gorkemguler/QuishScope.git"For local development:
git clone https://github.com/gorkemguler/QuishScope.git
cd QuishScope
python -m pip install -e '.[dev]'Python 3.10+ is required.
Inspect a decoded payload:
quishscope analyze 'https://example.com/account/verify'Decode and inspect an image:
quishscope scan suspicious-qr.pngProduce machine-readable output and fail only on high or critical risk:
quishscope scan --json --fail-on high qr-*.png > quishscope-report.jsonRead a payload safely from standard input:
printf '%s' 'https://example.com' | quishscope analyze -| Code | Meaning |
|---|---|
0 |
Analysis completed and no result reached --fail-on |
1 |
Analysis completed and at least one result reached --fail-on |
2 |
Input, decoding, or operational error |
Use --fail-on never when the report alone matters.
QuishScope does not resolve hosts, follow redirects, fetch reputation data, launch a browser, or submit payloads to a third party. Analysis is entirely local and deterministic. The project follows the practical guidance to preview and inspect QR destinations before visiting them.
pytest --cov=quishscope --cov-report=term-missing
ruff check .To refresh the vendored browser decoder:
npm ci
npm run vendor:webExplore the project site.
MIT © Görkem Güler