Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Allowlist Tester

Test a URL against your own allowlist with wildcard matching. Editing the URL or the list recomputes the allow / deny verdict and names the matching rule. Everything runs in your browser.

1. Enter the URL and the allowlist

Matching: host must match exactly or via a *. wildcard (which also covers the bare domain); a scheme prefix restricts the scheme; a path ending in * matches any path under it. Patterns without a scheme match any scheme.

Result
Verdict
ALLOW
1 matching rule(s)

Matched rules

shop.example.com

Test the Policy Before It Ships

An allowlist is only as good as its matching. A pattern that looks right can miss a subdomain, a path, or a scheme — and the first time anyone notices is when a legitimate scan is refused, or a URL that should have been refused slips through. Testing each real destination against the exact list before deployment turns policy into evidence.

Keep the list tight

Prefer exact hosts and specific paths over broad wildcards. Every * is a hole someone else can walk through — a wildcard subdomain covers every future subdomain, including ones you have not created yet.

Frequently Asked Questions

How do the patterns work?

One pattern per line. "example.com" matches that host exactly. "*.example.com" matches the host and all its subdomains. Adding a path with "*" matches any path under it, e.g. "example.com/shop/*". A lone "*" matches everything — useful for testing, dangerous as a real policy.

What does "deny" mean here?

Deny means the URL matched no allowlist entry, so a scanner enforcing this list would refuse it. It does not mean the URL is malicious — it means it is not on the list.

Does this check whether the URL is safe?

No. Allowlist matching checks membership only. An allowed domain can still host a malicious page, and a denied domain can be perfectly safe. This tester checks policy fit, not safety.

Is anything sent to a server?

No. The URL and the list are matched entirely in your browser. Nothing leaves the page.