SecureScanMobile-Based Zero Trust QR Code Security SystemExplore the app ↗A QR code hides the destination. SecureScan helps you understand the risk before you open the link.
Point your camera at a QR code.
Detected links are checked before access.
Checking the destination before you open it.
Backend analysis in progress…
Multiple engines flagged this link.
Avoid opening this destination.
SecureScan is a Mobile-Based Zero Trust QR Code Security System. Users scan a QR code, select a QR image, or enter a URL. The Android app sends the link to a Flask backend for URL validation and VirusTotal analysis before presenting a security result. Users can then inspect the findings, review scan history, and request another check.
SECURESCAN / OUR PURPOSETo develop a backend that analyses QR and manually entered URLs using the VirusTotal API, reuses stored results to reduce repeated API requests, and manages user data and scan history. Deploy it on Google Cloud with HTTPS.
To provide a user-friendly Android app with registration, login, camera QR scanning, gallery QR scanning, and manual URL input, so users can check links before accessing them.
To treat submitted URLs as untrusted until checked. Display clear classifications, engine percentages, and warnings, and support re-scanning for updated verification.
Explore the real app screens. Select a method for step-by-step instructions; every input uses the same backend checking process.
Follow the link from the Android frontend to the backend, database, and VirusTotal.
Play the flow, or select a component to learn its role.
The backend checks stored results first. If a new check is needed, it requests VirusTotal data; pending analyses may take time. The client receives the verdict before choosing to open a link.
Select a topic for a focused explanation of the design decisions behind the app.
The Android app provides Camera QR, Gallery QR, and Manual URL input. CameraX and ML Kit support camera scanning, while ML Kit reads QR codes from selected images. The extracted URL is sent to the backend; the app does not automatically open it.
Results show the classification, URL information, and security engine findings. A signed-in user can also review scan history and account information.
The backend handles authentication and scan requests. URL checks restrict accepted schemes to HTTP and HTTPS, reject embedded credentials and unsupported ports, and prevent requests to non-public network addresses.
Supported shortened links are expanded with limits on redirects and time, with connection pinning to reduce unsafe destination changes. These checks control URL handling; they do not prove that a site's content is trustworthy.
SQLite runs with the backend and stores user accounts, shared scan reports, and each user's scan visits. Passwords are stored as hashes rather than plain text.
The backend checks for a valid cached report before requesting a new analysis. User history links a person to their previous scans. Because history is stored on the server, it requires a connection to the backend.
The backend requests an available VirusTotal URL report or submits a URL for analysis when needed. Reports contain harmless, undetected, suspicious, and malicious engine counts. SecureScan uses these counts to calculate the displayed classification.
Each percentage is a category's share of reporting engines. It is not the probability that a link is safe. New analyses can be pending while the external service processes the request.
The project backend is deployed on a Google Cloud virtual machine, using Nginx and Gunicorn to serve the Flask application. HTTPS protects data in transit between the Android app and the server.
The frontend communicates with the backend, and the backend contacts VirusTotal. The app does not connect directly to SQLite. This website introduces and demonstrates the project; its interactive examples do not perform live scans.
SecureScan depends on available VirusTotal engine reports, internet access, and backend availability. External latency, quotas, or pending analyses can delay a result. A cached report reflects an earlier check.
A new phishing page or lookalike domain may have no detections. Safe means no malicious or suspicious findings in the returned report, not guaranteed safety. Always read the destination domain carefully and be cautious with sensitive information.
Swipe, scroll horizontally, or use the controls to explore each classification in the same space.
Percentages show each category's share of reporting engines. They are not the probability that a website is safe. Undetected means no verdict from that engine.
Switch between sample results to understand engine counts and percentages. The number of engines can vary from one report to another.
All report data on this website is illustrative. No URLs are submitted and no live security scans are performed.
Select each field to understand the information attached to a scan.
Try the history demo: filter a result, open its details, then re-scan the selected example.
This demo uses fictional records. Re-scan simulates the app interaction and preserves the selected classification; it does not contact the backend.
Understand who SecureScan is designed to help and where the project stands today.
Designed for people checking QR codes on posters, saved images, or links shared in messages. It supports students and everyday users who want a clearer view of potential risks.
SecureScan demonstrates the project's core scanning, verification, reporting, and history features. It should undergo further security review, broader testing, and operational preparation before a public production release.
These are areas for further preparation, rather than claims that production readiness has already been established.
Even after these steps, a security report cannot guarantee that every link is safe.
SecureScan brings QR scanning, URL validation, security findings, and scan history into one Android application. It supports the project's goal of helping users check links before access and understand potential risks.
No detection system can guarantee safety. Stay alert to new threats, lookalike domains, and requests for sensitive information.
Back to the beginning ↑Meet the project team ↗