Last updated 3 September 2026
Why reading before opening matters
A QR code is opaque by design. Nothing about the pattern tells you whether it leads to a menu, a payment page or something worse, and the sticker-over-a-real-code trick — quishing — works precisely because people scan first and look second. Most phone cameras now show the destination before opening it, but they show a shortened preview that can be truncated at exactly the point where a lookalike domain differs. Reading the full content as plain text removes that gap. This tool never follows what it finds: the decoded string is displayed, and opening it is a separate deliberate click. It uses the decoder already built into the browser rather than downloading a scanning library, which keeps the page light but does mean support depends on your browser.
How QR codes survive damage
A QR code stores considerably more data than it strictly needs, using Reed–Solomon error correction — the same family of techniques that lets a scratched CD play. Four levels exist, correcting roughly 7%, 15%, 25% and 30% of the code, which is why a code with a logo placed over its centre still scans reliably.
The three large squares in the corners are position markers, letting a scanner find the code and work out its rotation, which is why orientation does not matter. What does matter is the quiet zone: the specification calls for clear space around the code equal to four modules. Printing a code hard against a border or another element is one of the most common reasons a technically valid code fails to scan.
Read before you act
The genuine risk with QR codes is that a human cannot see where one leads before following it. Fraudulent codes stuck over legitimate ones on parking meters, restaurant tables and payment terminals have become common enough that the practice has a name, and the whole attack depends on people scanning and tapping in one motion.
Decoding a code to plain text first removes that. Read the destination and check it before opening anything: confirm the domain is what you expect, be wary of shortened links that hide the real target, and treat any page asking for payment details or a login after a scanned code with particular suspicion. On a physical code, it is also worth checking whether a sticker has been placed over the original — a raised edge or a mismatched surface is often visible once you look.
Common questions
Why does it not work in my browser?
It uses the browser's own built-in barcode decoder rather than downloading a scanning library, which keeps the page fast and adds no third-party code. That decoder exists in Chrome, Edge and most Android browsers, but not yet in Safari or Firefox.
Is my image uploaded?
No. The image is decoded in your browser and never leaves your device. The same applies to the camera — the video stream is processed locally and nothing is recorded or transmitted.
Does it open the link automatically?
No, deliberately. The decoded content is shown as text and opening it is a separate click. Automatic opening is exactly the behaviour that makes malicious QR codes effective.
What is quishing?
QR phishing — placing a sticker with a malicious code over a legitimate one, often on parking meters, restaurant tables or payment terminals. Reading the full destination before opening it is the simplest defence.
Why do QR codes still work when damaged or covered by a logo?
They include Reed–Solomon error correction, with four levels able to restore roughly 7% to 30% of the code. That redundancy is what allows a logo over the centre, or minor scratches and smudges, without preventing a scan.
Why does my code fail to scan even though it looks fine?
Most often the quiet zone. The specification requires clear space around the code equal to four modules, and printing it hard against a border or another element breaks scanning. Low contrast and inverted colours are the next most common causes.
Is it risky to scan a QR code?
The risk is that you cannot see the destination before following it, and fraudulent codes placed over legitimate ones are increasingly common. Decoding to plain text first lets you check the domain before opening anything, which removes most of the danger.