Why preview beats blind scanning
A QR code is only a shortcut. The risk sits in where the shortcut goes.
Native camera apps often follow links immediately. Here you see the string first. If the payload is a URL, you read the host before you open anything. If the payload is Wi-Fi, you read the SSID and security type before you join. We recommend treating unknown codes in public spaces the same way you treat email attachments from strangers: pause, read, then act.
Retail teams use workflows like this when validating print proofs. A sticker on a menu should match the domain you expect. If it does not, you reprint before guests scan.
What happens inside your tab
You supply pixels. The page draws them to an offscreen canvas, reads RGBA samples, and hands the buffer to jsQR. When a valid finder pattern and timing pattern line up, the library returns the encoded string. Your phone never uploads the frame to our servers because the script never sends it. Clearing the tab clears the image data from memory for normal browser hygiene.
Heavy blur, extreme glare, or a code smaller than roughly fifteen modules across the short edge often fails. A screenshot from a video usually fails because compression smears the squares.
Three ways people waste a perfectly good code
- Motion blur. A code printed four centimetres wide on a moving truck needs a faster shutter than a code on a desk.
- Inverted colours without enough contrast. Light modules on a dark background sometimes works, but pale grey on white rarely does.
- Cropping the quiet zone. Designers love tight crops. Decoders love a margin of empty space around the pattern.
Payload cheat sheet
| Prefix you might see | Meaning |
|---|---|
http:// or https:// | Web address. Check the hostname before you open. |
WIFI: | Network join helper with SSID and password fields. |
BEGIN:VCARD | Contact card. Safe to copy into your address book after you trust the source. |
| Plain text | Might hold a promo code, serial number, or sentence. Treat the payload as data, not an order. |
What this page refuses to do
There is no database of “safe” URLs and no reputation feed. We do not shorten links, rewrite hosts, or warn about phishing beyond showing you the literal string. If you need enterprise policy checks, route scans through tooling your security team operates.
Barcode symbologies other than QR (Data Matrix, Aztec, PDF417) are out of scope for jsQR. Use a dedicated barcode suite when labels mix formats.
Where teams still reach for a desktop reader
Event staff paste attendee badges into this style of tool when the handheld scanner battery dies. Support desks ask customers to email a photo of a shipping label, then decode the QR segment locally instead of opening mystery attachments on a mail client preview pane. Marketers sanity-check a campaign code after export from design tools.
For static assets you ship to social feeds, our image resizer helps you export square crops without shaving off the quiet zone.
Last reviewed: March 2025. Decoder library: jsQR 1.4.0 loaded from jsDelivr. If your organisation blocks third-party scripts, ask IT to allow the CDN or host the file yourself.
