A section of the QR generatorDecode a QR code

It is a payment QR code to GOST R 56042-2014, the format printed on Russian utility bills, tax notices and traffic fines. `ST` identifies the format, `0001` is the version and the last digit is the text encoding. After that, separated by vertical bars, come the payee details: name, settlement account, bank, BIC, correspondent account and tax number. A banking app reads the string and fills the payment form itself, which is why nobody normally sees it.

The encoding is set by the last digit of the prefix: one means Windows-1251, two means UTF-8 and three means KOI8-R. If the scanner read the string in a different encoding from the one it was written in, Cyrillic letters turn into random symbols while digits survive intact. The code itself is not broken — the details inside are correct and only their display is damaged. Rescan with another app, or ask the sender to rebuild the code in UTF-8.

In a payment code the amount is always written in kopecks with no separator. So `Sum=36000` means three hundred and sixty roubles rather than thirty-six thousand, and the hundredfold difference looks like a bug right up until you know about it. The tool shows both figures: the raw value and what it comes to in roubles. If the rouble figure still disagrees with the paper bill, the problem is in the code rather than the format.

Yes, and that is a property of the format rather than a hack: a `WIFI:` string stores the network name and the password as plain text, and any scanner reads them. So a code for your home network should not be printed in plain sight or posted online — whoever photographs it gets the full password. For visitors, set up a separate guest network whose password you do not mind sharing. Decoding here happens in your browser.

The string is decoded in your browser: it never reaches our server, is stored nowhere and never appears in the page address. That matters especially here, because a payment code carries bank details, a Wi-Fi code carries a network password, and a two-factor code carries a working access key. The tool does parse the two-factor secret but deliberately never displays it — capturing it in a screenshot would be far too easy.

The tool shows the whole string and says plainly that the format is unknown — that is not a decoding failure. A QR code can hold arbitrary text, and a great many codes are exactly that: a link, an order number, or a string that only the issuing application understands. Look at how the string begins: `http` means a link, `BEGIN:` a contact or an event, and `otpauth` a two-factor authentication code.