Skip to content

Trust & Safety

Last updated: October 2026

QRLynx blocks confirmed phishing, malware, and scam destinations before a QR code can be saved. Every saved URL-type QR goes through the URL safety gate at creation time; non-shortlisted destinations are checked against multiple independent URL threat-intelligence and reputation signals. Confirmed threats are blocked outright, and qualifying high-traffic active URL destinations are rechecked on a rolling daily schedule. Scanner safety pages depend on the account plan, QR route and check results. Reports filed against a QR code are reviewed by a human, and manual review can pause a QR completely. Static and dynamic QR codes have no automatic expiry and unlimited scans. Your saved project and short link are preserved when a code is paused for exceeding your plan's active allowance. Restore eligible codes within your available capacity to resume scans. After confirmed payment, supported billing recovery can also restore eligible paused codes automatically.

Is QRLynx safe?

Yes. QRLynx is a legitimate QR code platform operated by Jorbox LLC, a US software company in Albuquerque, New Mexico, and safety is enforced in the product rather than promised in policy. Saved URL-based QR codes pass through a multi-layer safety pipeline before publication: lexical risk scoring, DNS and domain reputation signals, and Google Web Risk screening for non-shortlisted destinations. Confirmed threats are blocked at creation, qualifying high-traffic active destinations are rechecked on a rolling daily schedule, and a code reported through the abuse form is reviewed by a human and paused if the report is confirmed. Scanner safety pages depend on the account plan, QR route and check results. Traffic is encrypted in transit with modern TLS, stored data is encrypted at rest on Cloudflare-managed infrastructure, QRLynx itself adds no third-party tracking pixels to scan pages. QRLynx also publishes its own security research. In QRLynx’s December 2025 through April 2026 cohort, 96 of 754 URL-type QR submissions (12.7%) required additional review at first assessment. A review flag alone does not establish that a destination is malicious. Anyone can report a suspicious code at qrlynx.com/report-abuse without an account. (Facts checked July 18, 2026.)

What we don't allow

QRLynx has a zero-tolerance policy for QR codes that redirect scanners to harmful content. We disable QR codes that point at:

  • Phishing and credential harvesting: fake login pages for banks, email providers, exchanges, social platforms, or any service that asks for credentials on a domain that doesn't own them.
  • Malware distribution: destinations that drop executables, drive-by-download payloads, mobile profiles, or browser exploit kits.
  • Scams and fraud: fake investment schemes, gift-card harvesters, "pay this parking fine" and "package undelivered" SMS scams, fake utility shutoff notices, and the rest of the smishing playbook.
  • Brand impersonation: QR codes that imply they're from a brand the creator doesn't own or represent, including fake support pages for major SaaS / banking / telco brands.
  • Illegal content: content that's illegal in the jurisdiction of the scanner or the QR creator, including CSAM, illegal drug sales, and trafficking.
  • Spam and concealed redirects: redirect services, link chains, or off-platform cloakers used to hide phishing, malware, scams, or another prohibited destination. These uses are not allowed and can be disabled after a security match, an abuse report, or manual review.

The full reporting flow lives on the Report Abuse page. You don't need a QRLynx account to file a report.

Why can a page appear before the destination?

QRLynx’s brief opening page shows the destination’s domain and provides a Report abuse link, helping people recognize where they are going and flag spam or misleading content. The page is ad-free. Eligible links on the Free plan use it as part of their normal redirect flow. Paid plans skip these QRLynx opening and safety pages and include direct redirects. Passwords, consent forms and other configured access screens can still appear when enabled.

How we detect abuse before a scan happens

QRLynx checks supported web destinations when codes are saved and rechecks qualifying high-traffic active destinations. Scanner safety pages depend on the account plan, QR route and check results. Reports of spam, phishing or other abuse can be submitted through Report abuse for review.

  1. Threat-intelligence lookup. For non-shortlisted destinations, QRLynx checks the URL against industry threat-intelligence and URL-reputation services. Known-malicious destinations are blocked at save time.
  2. Automated risk analysis. Each destination is scored by automated checks for the common signatures of phishing and scam URLs. High-risk destinations are blocked outright; uncertain results can lead to a safety page on eligible plans and QR routes.
  3. Domain reputation. QRLynx weighs destination and domain reputation signals, and gives well-established, widely-trusted services an allowlist pass to avoid false-positive friction.
  4. Rolling re-scan. The highest-traffic active dynamic URL destinations are re-checked on a rolling daily schedule, prioritized by scan volume, so a destination that was safe at save time but later compromised can be flagged for the applicable safety handling.
  5. Manual review. Reports filed through /report-abuse are triaged by humans, not auto-actioned. Clear, verifiable phishing reports are prioritized, and manual review can pause a QR completely.

Direct static formats, such as WiFi credentials, vCard contact details and calendar events, store their supported information in the QR image. URL-based types, including PayPal and Cash App links, point to a web destination and follow QRLynx’s applicable URL validation and safety workflow.

Quishing: the threat we're specifically built against

"Quishing", phishing via QR code, has been one of the fastest-growing attack categories since 2022. The attack is simple: print or paste a QR sticker on top of a legitimate one (parking meters, restaurant tables, package labels, payment terminals), wait for someone to scan it, and harvest credentials or payment data on the destination page. Because the QR is opaque to the human eye, traditional anti-phishing training (hover-the-link, check-the-URL) doesn't apply.

QRLynx is built specifically to make quishing harder. Every dynamic QR redirect runs through a QRLynx redirect domain and is owned by a real QRLynx account. That single fact means a confirmed malicious destination can be disabled on its own, without taking down legitimate QRs that share the same redirect infrastructure. The 2026 QR Code Security Report documents the URL-screening cohort and separate scan-event observations.

What happens when you report a QR code

Anyone, including people who don't have a QRLynx account, can report a QR code through the Report Abuse form. Every report gets a tracking ID. The flow:

  1. You submit the suspicious QR's short URL (or the destination URL, or both), pick a category, and describe what you saw.
  2. Our trust & safety team reviews the report. Clear, self-evident phishing or malware is actioned immediately.
  3. If we need more information, we email the address you provided (optional; reports can be anonymous).
  4. If the report is upheld, the destination is disabled and the QR redirect is paused, preventing the QR from opening the reported destination.
  5. We never disclose the reporter's identity to the QR owner. We do not sell abuse-report data; reports are processed only by the service providers we use to operate the reporting system.

Appeals and FAQ

We try hard to never take down a legitimate QR. Sometimes we get it wrong: automated security checks have false positives, and a legitimate domain can be reported in error. Here's what to do.

What happens when someone reports a QRLynx QR code?

Our trust & safety team triages every report. Reports that include a clear phishing, malware, or scam destination are prioritized: once a human review confirms the report, the destination URL is disabled and the QR redirect is paused. Reports without enough information get a follow-up email asking for the QR's short URL, a screenshot, or the suspicious destination.

What if my QR code was disabled and I think it was a mistake?

Email support@qrlynx.com from the email address on your QRLynx account, include the QR code's short URL, and describe what the destination actually does. We review every appeal promptly. If we agree the takedown was wrong, the QR is restored and analytics continue from where they left off.

Do you check destination URLs before they go live?

Yes. Supported web destinations pass through QRLynx’s creation-time validation and safety checks. Confirmed high-risk matches can prevent a code from being saved. Qualifying high-traffic active destinations are rechecked, and people can report suspicious content for review. Whether a scanner sees a QRLynx opening or safety page depends on the plan and QR route, as explained above.

What kinds of QR codes won't QRLynx let me create?

We block destinations classified as phishing, malware distribution, credential-harvesting login pages, investment scams, brand impersonation, and other content covered by our zero-tolerance policy. Redirect chains and cloaking services used to hide prohibited destinations are also not allowed. Our safety process checks the submitted URL for threat matches and suspicious patterns; abuse reports and manual review can identify and disable concealed redirects.

Can I report a suspicious QR code that isn't mine?

Yes. The /report-abuse page accepts reports from anyone; you don't need a QRLynx account. We never disclose reporter identity to the QR owner. The form shows a tracking ID after submission, and if you leave an email address we can follow up when more detail is needed.

Privacy and data minimisation

When someone scans a QRLynx dynamic QR, the owner-facing analytics dataset records geography at country/city granularity, device class, OS, browser, and referrer. Scanner IP addresses are used only in infrastructure-level processing such as unique-scan counting, abuse prevention, and standard platform logs; they are not shown to QR owners, not exported in scan CSVs, and not written as Analytics Engine dimensions. We don't fingerprint scanner devices.

Scan analytics live in Cloudflare's Analytics Engine, designed for high-volume time-series telemetry rather than personal profiling. The full data-handling story lives in the Privacy Policy.

QRLynx scan analytics records eligible activity through managed dynamic QR routes. Enterprise customers can also configure supported retargeting pixels on eligible routes and are responsible for their settings and privacy obligations. For QRLynx website measurement and available choices, see the Cookie Policy. The Privacy Policy explains the data processed, service providers, retention and deletion options.

Security disclosure for researchers

We welcome reports from security researchers. The security.txt file lists our contact channel, supported languages, and current policy. Email abuse@jorbox.com with a clear reproduction, affected URL or endpoint, and impact assessment. We review every report, fix issues we confirm, and credit researchers who report responsibly (if they want credit; anonymous reports are equally welcome).

We're a small team and don't currently run a paid bug-bounty programme. Reasonable, good-faith research that follows the coordinated-disclosure norm is appreciated and acted on.

Published research and reporting

Read our published QR Code Security Report for the study’s findings and methodology. You can report a suspicious QR code or contact support to request a review of a disabled code.

Check reviews, research and service status

QRLynx reviews on Trustpilot describe individual experiences with QRLynx. They can help you assess usability and support, but a review does not establish that every QR destination is safe or measure service uptime. Company replies on the profile are QRLynx's responses.

Our service status page shows the latest lightweight checks run by QRLynx. Our research methodology explains the evidence boundaries for QRLynx reports. Customer experiences, current service checks and security research answer different questions; use the source that matches yours.

Related