The QR scanner
that checks the link
before it opens.
Point your camera at any QR code. ScanHawk traces where it actually leads, reasons about it with AI, and hands you a verdict you can act on — in plain English, before anything loads.
Free on the App Store for iPhone and iPad. Not on Google Play yet — on Android, or on anything else, check a link in your browser instead: same engine, no install. Free on the App Store, no account and no ads. Rather not install? Check a link in your browser. The app is on the App Store; Google Play is not live yet. Check any link in your browser right now — same engine, no install, no sign-up.
Telling someone about it? The whole address is
scanhawk.io/get — short enough to say out loud.
Don't take our word for it.Point your camera and read where it goes before you tap — that is the whole habit. This one says scanhawk.io/ios, which forwards to the App Store.
A scanner that answers the only question that matters.
Every other QR scanner opens the link and lets you find out afterwards. ScanHawk puts the answer first — and tells you how it got there.
A verdict, first
Every code resolves to SAFE, SUSPICIOUS or DANGEROUS with a 0–100 risk score, shown before anything opens.
Plain-English reasoning
Not just "blocked" — why: brand impersonation, a credential trap, a chain of redirects hiding the real destination.
The real destination
Shorteners and redirect chains are traced to where they actually land, so you see the true site rather than the disguise.
Opening is gated
SAFE opens on a tap. SUSPICIOUS asks first and shows you where it goes. DANGEROUS defaults to don't, with a deliberately awkward override.
Works without signal
Wi-Fi codes, MFA setup codes, phone numbers and contact cards are answered on-device. Web links queue up and resolve — with a notification — the moment you're back online.
History you can revisit
Past scans stay on your phone with their verdict and reasoning, so you can look back at what a code was — and report one that was rated wrong.
Scan. Check. Decide.
The link is decoded on your device, then checked by the ScanHawk engine — domain age, TLS, URL heuristics and live threat-intel feeds in parallel, plus an AI layer that reasons about intent. The URL rules are what catch look-alike domains, punycode spoofs and hidden-destination tricks, with no blacklist required; the AI explains the verdict in plain English.
Scan
Point the camera at any QR code. Decoding happens on the phone.
Check
The link is traced through every redirect and analysed by the engine.
Decide
You get the verdict, the score and the reason — then you choose whether to open it.
Three verdicts. Zero ambiguity.
No red flags. A known destination with nothing suspicious in the link, the domain, or the page.
Something's off — a shortener, a young domain, an odd redirect. Proceed with caution.
A confirmed or strongly-indicated threat: phishing, malware, or credential theft. Don't open it.
No account. No profile. No ads.
- Nothing to sign up forThere is no account, no email, no password. Open the app and scan.
- We don't want your identityScanHawk doesn't collect personal information. A scan sends the link to be checked — not who you are.
- Your history stays on your phonePast scans live in local storage on the device, and you can clear them yourself.
- See and erase your own recordPrivacy & data in the app shows exactly what's held against your anonymous install ID, and lets you delete it.
- Free means freeNo subscription, no in-app purchases, no advertising, and nothing sold on. Every scan gets the full verdict and reasoning.
What ScanHawk can't do
ScanHawk can be wrong. Attackers work hard to evade tools like this, and a destination can change after we check it — so a SAFE result means we found no evidence of a threat, not that a link is guaranteed safe. Treat every verdict as advice, keep your devices updated, and use your own judgement.
Before you download.
- Is it really free?
- Yes. No subscription, no in-app purchases, no ads. Every scan gets the full verdict, the reasoning and the redirect trace.
- Do I need an account?
- No. There's nothing to sign up for and no email to hand over.
- What if I have no signal?
- Wi-Fi codes, MFA (
otpauth) codes, phone numbers, contact cards and plain text are answered on the device with no network at all. Web links need the engine, so they queue and resolve automatically — with a notification — as soon as you're back online. - Does it work on scanned codes only?
- The app is built around the camera. To check a link you already have — from an email or a message — you can paste it into the web checker right now.
- Is there an Android version?
- Not yet — ScanHawk is on the App Store for iPhone and iPad today, and Google Play is not live. On Android the browser checker runs the same engine with nothing to install.
- What if a code is rated wrong?
- Report it from the app. Reports go into a review queue, and confirmed ones roll into the protection everyone gets.
- I build a scanner. Can I use the engine?
- Yes — the same engine is available as an API. See scanhawk.io.
- Something's broken. Who do I talk to?
- Email support@twentypin.com, or read the support page.
Know before
you tap.
Free on the App Store. No account, no ads — just a straight answer about where that code goes.
Check it, then scan it.Your camera shows you where a code goes before you open it. This one says scanhawk.io/ios — if it says anything else, do not tap it.
Want a note when it reaches Google Play?
One email, once, when it reaches Google Play — nothing else, and you can unsubscribe from it. See the Privacy Policy.
Want a note when it reaches Google Play? Email support@twentypin.com.
Free, and free for good. No account, no ads, no in-app purchases.