Separate decoding failure from a suspicious result

If a QR reader finds no result, check the image before assuming the code contains nothing. Preserve the square code and the clear border around it, avoid motion blur, and use an original screenshot instead of photographing another display where possible. A cropped finder pattern or a reflection can prevent a decoder from recognizing the symbol.

Once decoded, treat the returned text as untrusted input. Read the complete domain of a URL, including misspellings and unexpected subdomains, before opening it. A successful decode establishes that a pattern contains that text; it does not establish the identity of the sender or the safety of the destination. Codes can also contain contact information, Wi-Fi details or plain text, so do not assume every result should be opened as a web page. Keep private credentials out of a screenshot you later share for troubleshooting.

Use a screenshot when possible

Screenshots usually decode more reliably than photos of screens because they avoid glare, blur, and perspective distortion.

Make sure the full QR code is visible, including the blank border around it. Cropping too tightly can remove the quiet zone that readers use to find the code.

Inspect before opening

A local QR reader should show the payload as text instead of automatically opening the link. That matters for parking meters, posters, menus, payment codes, and other public QR codes where stickers or lookalike domains can be used for scams.

Short links only reveal the first hop. If the decoded result is a shortener, treat it as a warning to verify the destination more carefully.

Keep private codes local

QR codes can contain Wi-Fi passwords, contact cards, payment requests, calendar events, and private links. Browser-local decoding keeps the selected image in the current tab instead of uploading it to a server.

Reading the destination does not prove it is safe. It gives you visibility before you make the choice.