diff --git a/CMakeLists.txt b/CMakeLists.txt
index bcd93be..cf2301d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.5)
-project(OTPClient VERSION "2.4.8" LANGUAGES "C")
+project(OTPClient VERSION "2.4.9" LANGUAGES "C")
 
 configure_file("src/common/version.h.in" "version.h")
 include_directories(${PROJECT_BINARY_DIR})
diff --git a/data/com.github.paolostivanin.OTPClient.appdata.xml b/data/com.github.paolostivanin.OTPClient.appdata.xml
index fe6a846..674b29e 100644
--- a/data/com.github.paolostivanin.OTPClient.appdata.xml
+++ b/data/com.github.paolostivanin.OTPClient.appdata.xml
@@ -83,6 +83,15 @@ It's also possible to import/export backups from/to andOTP and import backups fr
   </content_rating>
 
   <releases>
+    <release version="2.4.9" date="2022-02-28">
+      <description>
+        <p>OTPClient 2.4.9 fix an import issue</p>
+        <ul>
+          <li>fix importing QR code (issue#240)</li>
+          <li>better error when importing a QR fails</li>
+        </ul>
+      </description>
+    </release>
     <release version="2.4.8" date="2022-02-18">
       <description>
         <p>OTPClient 2.4.8 brings a couple of fixes</p>
diff --git a/src/add-common.c b/src/add-common.c
index b81c846..dc0708a 100644
--- a/src/add-common.c
+++ b/src/add-common.c
@@ -40,10 +40,9 @@ check_params (GSList *otps)
         return g_strdup ("Label can not be empty, otp not imported");
     }
 
-    if (otp->secret[0] == '\0') {
+    if (otp->secret == NULL || otp->secret[0] == '\0') {
         return g_strdup ("Secret can not be empty, otp not imported");
     }
-
     if (g_ascii_strcasecmp (otp->type, "TOTP") == 0) {
         if (otp->period < 10 || otp->period > 120) {
             gchar *msg = g_strconcat("[INFO]: invalid period for '", otp->account_name, "'. Defaulting back to 30 seconds.", NULL);
diff --git a/src/parse-uri.c b/src/parse-uri.c
index 4ded2c6..d4c7d1f 100644
--- a/src/parse-uri.c
+++ b/src/parse-uri.c
@@ -72,7 +72,7 @@ parse_parameters (const gchar   *modified_uri,
     const gchar *mod_uri_copy = modified_uri;
     gchar **tokens = g_strsplit (mod_uri_copy, "?", -1);
     gchar *escaped_issuer_and_label = g_uri_unescape_string (tokens[0], NULL);
-    mod_uri_copy += g_utf8_strlen (tokens[0], -1) + 1; // "issuer:label?"
+    mod_uri_copy += g_utf8_strlen (tokens[0], -1) + 2; // "issuer:label?"
     g_strfreev (tokens);
 
     tokens = g_strsplit (escaped_issuer_and_label, ":", -1);
@@ -88,6 +88,7 @@ parse_parameters (const gchar   *modified_uri,
     tokens = g_strsplit (mod_uri_copy, "&", -1);
     gint i = 0;
     while (tokens[i]) {
+
         if (g_ascii_strncasecmp (tokens[i], "secret=", 7) == 0) {
             tokens[i] += 7;
             otp->secret = secure_strdup (tokens[i]);