Scan QR codes on screen, without getting phished
QR codes are on web pages, in PDFs and in video calls. Your phone is not always handy. Frayo reads them on your Mac and checks the link before you open it.
A QR code is a link you cannot read. That is why it is a favourite of phishing: a code on a fake invoice or a "scan to verify" email takes you to a page that looks right and is not.
On a phone, you point the camera and tap. On a Mac, you often have no good way to scan a code that is on your screen. So people photograph the screen with their phone, which is awkward and gives the same blind trust.
How it works
Press ⌥⇧9. Drag over the QR code. That is it.
Frayo reads the code on your Mac, using the text and barcode recognition built into macOS. Nothing is uploaded. What the code says goes to your clipboard.
If it is a web link, a message appears: "Copied link to example.com", with a button, Open example.com. The button names the real site you will visit.
Frayo never opens a link by itself. You decide.
The safety check
When you click Open, Frayo first looks at the link. If it has one of these warning signs, you see a dialog that lists the reasons and shows the full address. You can cancel, or choose Open Anyway.
- It isn't encrypted. The link starts with http, not https.
- Look-alike characters. The address uses international characters that imitate a familiar name.
- A bare IP address. Real services rarely send you to a string of numbers.
- A short link. Well-known shorteners such as bit.ly hide where the link really goes.
- A disguised address. Text before an "@" can make a link look like one site while it opens another.
If none of these apply, the link opens normally.
What this check is, and is not
It is a quick filter for common tricks. It looks only at the link's shape. It does not visit the page, and it does not know whether a site is trustworthy. A phishing site on a normal https address passes the check. Treat the check as a second pair of eyes, and still read the host name in the button.
Other things it reads
It is not only for links. It also reads barcodes and codes that hold plain text. If an area has several codes, all are copied, one per line. If it finds nothing, you hear a sound and see "No QR code or barcode found".
Where it helps
- A code in a video call or screen share
- A code in a PDF or on a web page
- A code in a screenshot you were sent
- A code on a second display
Nothing is saved when you scan. Frayo uses a temporary file for the moment of reading, then deletes it.