TrustScanWho makes TrustScan
TrustScan is built by Umaid Ali, an independent developer in Pakistan. It is one app and one website, not a portfolio — the QR scanner has been shipping on Google Play since 2026 and the link-safety engine on this site is the same code the app runs on your phone.
Why a QR scanner needed building
Most QR scanners open whatever they read. That was fine when QR codes were a novelty on magazine adverts. It stopped being fine when criminals worked out that a printed sticker over a real code on a parking meter is the cheapest phishing campaign ever devised, and that nobody can read a QR code by eye to tell the difference.
TrustScan reads the address first and runs twenty structural checks on it — lookalike alphabets, punycode, brand impersonation, obfuscated IP addresses, open redirects, credential-harvesting paths — and shows you what it found before anything opens. All of it runs on the device. No link you scan is sent anywhere to be rated, which means no record of what you point your camera at exists to be leaked or sold.
How this site relates to the app
The link checker here is a direct port of the app's safety engine
(lib/services/url_safety.dart). The QR generator is a
from-scratch encoder that runs in your browser. Neither sends anything to
a server, because there is no server — this is a static site, and the
claim that nothing is uploaded is verifiable by opening your browser's
network tab.
That is not a marketing position. A privacy-focused scanner whose website quietly logged every code you generated would be a contradiction worth being angry about.
What we get wrong, and what we do not claim
The checks are structural, not a live blocklist. They catch deception built into the shape of an address — which is what the sticker-over-a-poster attack relies on — but they will not know that an ordinary-looking domain was compromised this morning. A reputation lookup would catch that, and would also mean sending every link you scan to a server. We chose not to, and this is the cost of that choice.
Hyphenated brand names are reported as a caution rather than a danger,
because apple-orchard.com is a real shape. Some false alarms
are the price of catching apple-support.com.
Contact
Corrections, false positives and missed detections are the most useful mail we get. If a link should have been flagged and was not, send the exact address to info@trustscanqr.com.
TrustScan · Tando Adam, Pakistan · info@trustscanqr.com