The app
Scan, match, and the moment it doesn't.
A crypto address is 42 random characters. An IBAN is 20. Nobody reads them — we all check the first four and the last four, which is exactly the gap attackers aim at. DoublyCheck reads the whole thing with your camera and compares it, character by character, against the address you already trust.
Saved
Scanned
Illustrative examples. The app compares on-device and never sends an address anywhere.
What it is
DoublyCheck is a camera and a memory. The camera reads the address in front of you — on a screen, on paper, on a hardware wallet display. The memory holds the addresses you've decided to trust, encrypted on your phone.
Put the two together and you get the one thing no wallet and no banking app gives you: an answer to "is this the same address as last time?"
It is not a wallet. It holds no keys, moves no money, and has no balance. It doesn't replace your bank or your exchange — it checks the destination before you commit to one.
How it works
Every step runs on the phone in your hand. Nothing is uploaded, because there is nowhere to upload it to.
Point the camera at an address — a QR code, a line of text on a website, a printed invoice, the screen of a hardware wallet. Text recognition runs locally on the device.
Bitcoin, Ethereum and IBAN all carry a built-in checksum. DoublyCheck verifies it immediately, so a misread character is caught as a structurally invalid address before any comparison runs.
Against a saved entry, against your clipboard, or against a second scan from another source. Every character is checked, and the ones that differ are highlighted — including the middle ones your eye skips.
One thing DoublyCheck is deliberately not for: scanning an address and then typing the result into your wallet. That inverts the whole idea. The app exists to confirm that two independent sources agree — not to become a third source you have to trust.
Who it's for
The same check, aimed at two very different threats. Pick the one that sounds like your week.
For crypto
Clipboard hijackers and address-poisoning attacks both work the same way: they hand you an address that starts and ends exactly like the right one. Copy, paste, send, gone. No chargeback, no support line.
For paying invoices
You've paid this supplier eleven times. The twelfth invoice arrives with a different IBAN and a plausible note about a new bank. The recommended control is to check it against what you paid last time — which normally means digging through old statements.
Inside the app
Read a QR code or plain text off any surface — a monitor, a paper invoice, a Ledger display. Text recognition and decoding both happen on the device, with no network permission needed to do the work.
"Cold storage." "Kraken withdrawal." "Müller GmbH." An address you've labelled and confirmed once becomes the reference for every check after it — which is what turns a scanner into a control.
Every scan is timestamped locally. An address you've used sixteen times since January looks very different from one you're seeing for the first time.
A garbled scan almost always breaks the address checksum. DoublyCheck tells you the read was bad instead of quietly comparing the wrong string.
IBANs are personal data under the GDPR, so the address book is encrypted locally and flagged to stay out of device backups.
The app
Supported formats
That's not a coincidence — it's the selection criterion. A format with a checksum can be validated before it's compared, so a bad camera read is caught as a bad read rather than reported as a mismatch.
Legacy and P2SH (Base58Check), plus SegWit and Taproot in Bech32 and Bech32m.
EIP-55 mixed-case checksums, so a single wrong character is detectable rather than merely unlucky.
The ISO 13616 mod-97 check digits, validated for every country that uses the format — so a mistyped or misread IBAN is rejected before you compare it to anything.
Privacy
A list of the addresses you pay is a map of who you deal with and what you hold. The only defensible place for it is your phone.
Scanning, matching and storage all happen locally. No scan and no address leaves the phone.
Nothing to sign up for, nothing to breach, no password to reset.
The address book is encrypted on device and kept out of automatic backups.
No analytics SDK, no advertising identifier, no third-party code watching you work.
Watch
Scanning an address, saving it under a name, and catching the moment a second scan doesn't agree with the first.
Free to use, with an address book that grows when you want more room. No account, nothing to configure.