Is ZapQR safe?
ZapQR relays your password through its own relay.zapqr.ai server as base64 text with no encryption of its own.
When you use ZapQR's QR code login feature, the browser extension polls relay.zapqr.ai every 2 seconds waiting for your phone to submit a credential. The phone's answer arrives as a base64-encoded string that the extension simply decodes (no decryption step), so relay.zapqr.ai and anyone who can read its traffic or logs sees the plaintext username and password in transit. This differs from the extension's separate Bluetooth "Walk-Up Unlock" feature, which does encrypt the credential end-to-end before it leaves the device.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed ZapQR contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- relay.zapqr.ai
ZapQR sends data to relay.zapqr.ai. No other extension we have analyzed sends data here.