QR code decoding is the process of reading a QR symbol and extracting the data it contains, such as a URL, phone number, or text. In security tools, decoding turns an image into something that can be analyzed like a normal link. That matters because many defenses are stronger when they can inspect a visible destination before a user opens it.
Attackers use QR codes to hide malicious links inside images, a technique often called quishing. This can help phishing messages evade scanners that focus on plain-text URLs or attachments. On the defensive side, mail gateways and mobile security tools may decode QR images, compare the embedded destination against reputation data, and apply time-of-click protection when the link is opened. Treating QR codes as clickable links, not harmless pictures, is a key part of modern phishing defense.