The barcode scanner already in your pocket

Your phone scans.
Your computer gets it.
A tunnel in between.

Open ScanTunnel in your computer’s browser, point your phone at the QR code, and the camera becomes a scanner. Every code lands in a list on your screen in a split second. Nothing to install — and the server can’t read a single value.

Start scanning soon How it works
  • 0 apps to install
  • 2 screens: phone and computer
  • AES-256 from camera to screen
No installNo sign-upEnd-to-end encryptediPhone & Android14 barcode formatsWorks on flaky networksExport to ExcelSelf-hostable

01 · How it works

Three steps, zero cables

No handheld scanner, drivers, Bluetooth pairing or account. Just a browser on two devices.

  1. 1

    Open ScanTunnel on your computer

    The page creates a session with its own encryption key and shows a QR code. The key is born in your browser and never leaves it.

  2. 2

    Point your phone at the QR

    The regular camera app opens the link — and the scanner page is already paired with your computer. Several phones can join at once.

  3. 3

    Scan away

    Barcodes, QR, DataMatrix — everything flows into the list on screen. Search, spot duplicates, export to CSV for Excel.

02 · End-to-end encryption

The server carries your data but can’t see it

Every scan is encrypted on the phone and decrypted only in your computer’s browser. In between travels a sealed envelope.

📱 Phone sees

4607001771562 EAN-13 · plain text

☁️ Server sees

iv: 3fQk… ct: Zr8x… AES-GCM · 256-bit

💻 Computer sees

4607001771562 decrypted locally
How exactly does it work?keys, hashes and an honest threat model

https://…/s#r=Xk2…&k=pQ9…

The key lives after the “#”

Browsers never send the part of a link after # to the server. So the key never shows up in requests or logs.

HKDF-SHA256 → encKey + authToken

The server stores only a hash

One secret yields both the encryption key and an access token. The server only knows the token’s SHA-256 — not enough to open the session.

QR = qrcodegen(browser)

The QR is drawn on your screen

The server never renders the QR image — it would have to learn the key. Sessions idle for 7 days are deleted.

Honestly: what it protects against, and what it doesn’t

Protects

  • Server disk, backups and logs hold ciphertext only
  • An admin with server access can’t read the values
  • Knowing the site password isn’t enough — you also need the QR
  • CSRF: custom header, Sec-Fetch-Site, JSON only

Doesn’t protect

  • A compromised server serving tampered page code — a limit of any web E2E
  • Someone photographing the QR on your screen
  • Metadata: the number, timing and size of scans are visible

03 · Features

Built for real work, not a demo

Two scanning modes

Confirm — the frame freezes, you check the code and tap “Send & next”. Auto — hands-free flow: the same code is accepted again only after it leaves the frame.

“Already in list ×2”

The phone decrypts the list itself and warns you if a code was already scanned. On the computer — a “duplicates only” filter.

Lost signal? No problem

Scans queue up on the phone and are sent when the connection is back. Retries never create duplicate entries.

CSV, TXT, JSON

One-click export. CSV opens in Excel correctly and is guarded against formula injection.

Several phones

Share the QR with colleagues — everyone scans into one shared list, and the computer shows how many devices are connected.

Nothing gets lost

Reloaded the tab, laptop went to sleep, server restarted — the list comes back in exactly the same order.

14 formats — from groceries to logistics

  • EAN-13
  • EAN-8
  • UPC-A
  • UPC-E
  • ISBN
  • Code 128
  • Code 39
  • Code 93
  • ITF
  • Codabar
  • QR
  • DataMatrix
  • Aztec
  • PDF417

Chrome and Android use the built-in barcode detector; iPhone and Firefox use a fast zxing engine on WebAssembly.

04 · Who it’s for

Anywhere codes need to get into a computer

Warehouse & stocktaking

Walk the shelves with your phone — the laptop has a ready-made sheet to reconcile.

Retail & receiving

Check deliveries by EAN without buying handheld terminals. Several staff — one list.

Libraries

Book ISBNs straight into your catalogue spreadsheet. Duplicates flagged right on the phone.

Events

Check-in by QR ticket: who’s arrived is visible on the screen at the desk.

IT & service

Equipment serial numbers and asset tags without typing them by hand.

Just for you

Home library, collections, pantry inventory — faster than typing.

05 · Your own server

Open source. Host it yourself in an evening

Python + SQLite + nginx, no Docker and no runtime dependencies from the outside: all libraries live in the repo with pinned hashes. One script sets up the server, TLS and password.

  • One process, one database file — easy to back up
  • No CDNs, no third-party trackers
  • Separate dev and prod, one-command rollback
Source on GitHub soon
~/scantunnel
# locally
$ make venv && make dev
→ http://127.0.0.1:8770

# server, once
$ sudo ./deploy/bootstrap.sh --instance prod \
    --domain scan.example.com --htpasswd-ask
✓ nginx  ✓ systemd  ✓ sqlite  ✓ tls

# updates
$ make deploy-dev REF=main
$ make deploy-prod

06 · Questions

Frequently asked

Didn’t find an answer? Ask on Telegram: @nemilya

Do I need to install anything on my phone?

No. The scanner is a regular web page. The camera works right in the browser: Safari on iPhone, Chrome on Android.

The camera won’t open — what now?

Browsers only allow camera access over HTTPS and after you grant permission. Make sure the camera is allowed for the site and the address starts with https://.

Won’t it create a pile of duplicates?

A code is accepted after two identical reads in a row and only if it’s centred in the frame. In Auto mode the same code counts again only after it leaves the frame. And if the value is already in the list, the phone tells you so.

Where is my data stored, and for how long?

The server only holds encrypted envelopes that are useless without the key from the QR. A session untouched for 7 days is deleted entirely. The “Clear” button wipes the list immediately.

How many codes can I scan?

Up to 5,000 per session — beyond that the oldest entries roll off. For a new job just hit “New session”: you get a fresh room and key.

Can I connect several phones?

Yes. Everyone who scanned the QR on your computer writes into the same list. The computer shows how many phones are online.

Launching soon

Your phone is already the scanner.
We’re putting on the finishing touches.

Want early access, have a use case, or just a question? Drop me a line on Telegram.

Message @nemilya