Scanner safety method
QR and barcode safety: decode a file without trusting its payload
A QR code is a compact data container, not a trust signal. Decoding it locally can reveal what it contains without automatically navigating to a link, joining a network, or executing an action.
On this page
Decoding and trusting are separate decisions
A scanner can report text, a URL, Wi-Fi configuration, contact card, payment string, or another payload. It cannot determine whether the payload came from a trusted source or whether following it is appropriate.
Aftermath shows decoded values for review and does not open them automatically. This leaves the user in control of the next action.
Review the exact scheme before acting
A normal-looking code can contain an unusual scheme, a shortened URL, credentials, or a network configuration. Read the full value, confirm the sender, and compare the destination domain with what you expected.
A Wi-Fi payload is especially sensitive because it can include a network name and password. Copy it only when you recognise the source and understand the device action that will follow.
| Observation | Safe interpretation |
|---|---|
| A QR code decodes to an HTTPS URL | It is a URL to review, not proof that the site is safe. |
| A code decodes to Wi-Fi settings | It is configuration data; it does not join a network by itself. |
| No result is found | The image may be too small, blurred, cropped, unsupported, or contain no readable code. |
| Several results are found | Review each value and its source context separately. |
Keep batch results safe to export
A batch scanner should preserve which source produced each result and avoid turning decoded text into executable spreadsheet formulas or automatic links. A result export is a review aid, not a signal to trust every payload.
Do not add private code contents to analytics, URLs, or support reports unless you have a clear reason and permission to do so.
When a manual check is the right answer
If a code is physically suspicious, claims urgency, or points to an unexpected action, stop at the decoded text. Verify it through an independent trusted channel rather than using the scan result as a shortcut.
Use a local tool