Good News: This Is Always Solvable
The QR scanning step is the clumsiest moment of 2FA setup, and it is also the least essential one. Every setup QR code is just a wrapper around a plain text secret, and every service that offers a QR also offers that same secret as typeable text. So worst case, you skip the camera entirely and type the key by hand. But let's work through why the scan is failing first, because it is almost always one specific, fixable thing, not a broken account or a broken app.
Six Real Causes, and the Fix for Each
1. Screen brightness and glare
Screen-to-camera scanning is a light problem before it is anything else. A dim laptop screen or a phone display set to auto-brightness in a bright room often is not putting out enough contrast for the camera to lock focus on the QR's fine modules. Push the displaying screen to maximum brightness first, every time, before troubleshooting anything else. Then check glare: tilt the screen or the phone a few degrees so window light or an overhead lamp slides off the surface instead of bouncing straight into the lens. Glossy laptop screens and phone screens with a case-mounted screen protector are the two most common glare offenders.
2. Camera permission was never granted
If the authenticator app shows a black square, a frozen preview, or an error the moment you tap the scan button, it almost certainly does not have camera access, and the app is failing silently instead of asking again. Go to your phone's Settings, then Apps, find the authenticator app by name, open Permissions, and set Camera to Allow. On iOS this lives under Settings, then the app name directly, then Camera. This single check resolves a surprising share of "the scanner won't even open" reports, because many phones only prompt for camera access once, on first install, and a "not now" tap there sticks silently forever.
3. You are scanning a screenshot, not a live screen
A screenshot of a QR code is frequently lower resolution than the live rendering was, especially if it was cropped, resized by a messaging app's compression, or scaled up after the fact to look bigger. Compression artifacts blur the sharp black-and-white edges that a QR decoder depends on, and the scanner simply cannot find clean module boundaries in a fuzzy image. If you are trying to scan a QR from a screenshot someone sent you rather than from the live setup page, go back to the original page and scan the code as it renders live, at full resolution, whenever that is possible. If it is not possible, our free QR decoder will read a soft screenshot far more reliably than a phone's live camera scanner will, because it processes the raw pixel data instead of a moving camera feed.
4. Dark mode is inverting the QR's colors
Some websites render their QR generator inside a dark-mode-aware component, and a rendering bug flips the QR to white modules on a black background, or applies a CSS filter meant for photos to what is actually a binary code. Standard QR decoders expect dark modules on a light background and will refuse to lock on to an inverted or filtered image even though it looks perfectly readable to a human eye. Toggle the website itself to light mode (usually a sun or moon icon in the header or footer) before scanning, generate the QR again, and try the scan on the freshly rendered light-background version.
5. The setup session simply expired
Many services generate the setup QR against a short-lived session token, and that token times out after a few minutes of inactivity, exactly the amount of time you might spend hunting for your authenticator app or fixing your camera permission. An expired QR still displays fine, still looks scannable, and will scan successfully in the sense that the camera reads it, but the site will then reject the confirmation code because the session behind that QR no longer exists. If you have been on the setup page for more than five minutes, refresh it to generate a brand new QR and secret before troubleshooting anything else. This is one of the most overlooked causes because nothing about the QR itself looks wrong.
6. The wrong app, or the wrong scanner, opened it
Scan from inside the authenticator app's own add-account button, not your phone's general camera app. The general camera app may hand an otpauth link off to whichever app the phone considers the default handler, which may not be the authenticator you intended, or it may just display the raw link as text with nothing to do with it. If you have more than one authenticator installed, this routing problem gets worse: always open the specific app you want the account to live in and scan from its own scanner screen.
A QR code is text wearing a costume. Our QR and 2FA post shows exactly what is inside one. The camera is a convenience, never a requirement, which is why the fallback below always works even when nothing above does.
The Fallback That Always Works: Manual Entry
- On the setup page, click "Can't scan?", "Enter key manually", or "Setup key". Every service places this link near the QR, usually directly beneath it.
- The site reveals a text secret, a Base32 string that looks something like
JBSW Y3DP EHPK 3PXP. The format is explained fully in our Base32 guide. - In your authenticator, choose add account, then "Enter setup key". Type an account name you will recognize later, then paste or type the secret. Spaces in the displayed key are just visual grouping and do not matter.
- Select "Time based" if the app asks, confirm, and type the six digit code the app now shows back into the website's verification box.
For the full walkthrough, including the exact typos that trip people up during manual entry, see our manual setup key guide. That secret is also worth keeping: recorded offline, it can regenerate your codes in any app forever, and you can confirm it works correctly using our own browser TOTP generator before you rely on it live.
Decoding a QR You Already Have as an Image
If all you have is a saved screenshot rather than access to the live setup page, most authenticator apps can import directly from a photo (look for a gallery or image icon on the scan screen). Alternatively, decode the image straight to its raw text with our QR decoder, then manually enter the secret from the revealed otpauth link exactly as described above. Delete the screenshot once you are done: a stored 2FA setup QR is your secret sitting in plaintext, as our QR and 2FA post explains in more detail.
Frequently Asked Questions
The site shows no QR at all, just a broken image icon. Now what?
Ad blockers and strict privacy extensions occasionally block the script that draws the QR. Try a private browsing window or a different browser with extensions disabled. The manual key link on the same page works regardless of whether the QR itself ever renders.
I scanned successfully but the confirmation code is rejected. Why?
The scan worked, so the problem moved downstream, and it is almost always your device's clock. Set date and time to automatic on your phone and try a fresh code. Our time sync guide has the complete fix.
Can I scan the same QR into two apps for a backup?
Yes. During setup, before you confirm, you can scan the same code into two devices or apps. Both will generate identical valid codes going forward, giving you a built-in backup. Confirm the site's verification step once and both stay valid indefinitely.
Why do some QR codes scan instantly while others take forever?
Content size is the main factor. A long otpauth link, driven by a lengthy issuer name or account label, means denser and finer modules that demand better focus and better light than a short, simple code needs. That is physics, not a fault in your phone, and the fixes above compensate for it directly.
Is it safe to scan a 2FA QR code in a public place?
Mind shoulder surfers and nearby cameras. Anyone who photographs your setup QR while it is on screen owns your future codes just as completely as if they had watched you type a password. Enroll sensitive accounts somewhere private, and treat the QR the same way you would treat writing a password down on paper.
