QR Payload Auditor
Inspect the exact text a QR code carries before it is locked into packaging, signage, a card, or a printed campaign.
Input and output
Supply one already-decoded payload per non-empty line through a .txt file, a folder of text files, or --stdin. The standard-library Python scanner returns a rule ID, severity, file, line, and message for every finding.
The workflow is local and read-only. It does not rewrite the payload, generate a QR image, or open the destination.
The six rule families
- A URL-like value without an accepted absolute
http:orhttps:scheme. - An HTTP(S) hostname on the shipped editable list of common URL shorteners.
- A payload beginning with
javascript:,data:, orfile:. - A value longer than the configurable 180-character review threshold.
- A malformed
WIFI:,MECARD:, ormailto:form within the checks the scanner implements. - A Wi-Fi password field or URL query key named
token,api_key,password, orsecret.
A representative report
High and medium findings make the command exit nonzero. Low findings are review prompts. The report identifies the supplied text; it does not resolve the final site or decide whether that site is trustworthy.
The length threshold is not a printability test
The shipped configuration reports payloads over 180 characters at low severity because longer values deserve an explicit review. That number is a configurable local heuristic, not a universal QR capacity or scan-reliability limit.
Whether a printed symbol scans depends on the encoded data, QR version and error correction, module size, quiet zone, contrast, material, damage, camera, lighting, and distance. This package does not inspect any of those image or print variables.
What remains unknown
The scanner does not decode QR graphics, expand shortened URLs, follow redirects, fetch destination content, detect spoofed domains, verify domain ownership, confirm HTTPS configuration, or monitor what a dynamic destination does later.
Its Wi-Fi, MECARD, and mailto checks are intentionally narrow. A clean report is not a certificate that every scanner app will interpret the payload identically or that the printed code is safe.
Run the full pre-print payload check
The guide separates the decoded payload from the QR image, verifies the intended domain and action, treats shorteners as unresolved, checks credentials and actionable formats, and preserves a human-readable fallback before a print run.
Read the QR payload preflight guide →Questions
What input does QR Payload Auditor inspect?
It reads non-empty lines from .txt files, folders of .txt files, or stdin. Each line is treated as one already-decoded QR payload.
Does it decode a QR image?
No. Image decoding is outside the package. Decode the QR separately, then supply the exact text so the scanner can inspect the payload.
Which unsafe schemes does it flag?
The shipped rule flags payloads that begin with javascript:, data:, or file:. It does not claim to classify every registered or application-specific URI scheme.
Does it reveal where a shortened URL goes?
No. It compares the hostname with a shipped editable list of common shorteners and reports a low-severity review flag. It does not call the network or resolve redirects.
What credential-like data does it detect?
It flags a password field in a WIFI payload and URL query parameter names token, api_key, password, or secret. It does not scan arbitrary text for every possible secret format.
Can a clean report prove the QR code is safe and scannable?
No. The report covers the decoded text and local rules only. It does not inspect the image, print quality, destination content, redirects, domain ownership, browser behavior, or future changes.
Check the code before it goes to print.
Current price and purchase option are shown on Agensi. The package is local and read-only and works with agents that read SKILL.md.
Get the QR Payload Auditor on Agensi