QR Code Reader

How to read a QR code

From an image (photo or screenshot)

1. Click the drop zone Choose or drop an image containing a QR code, or drag a file onto it. PNG, JPEG, WebP, GIF and most formats your browser can display work, including screenshots of a QR code received by email or in a PDF.
2. The decoded text appears under Decoded content, with its Content type (web address, Wi-Fi network, contact card…).
3. Press Copy text to copy it.

From your camera

1. Press Scan with camera and allow camera access when your browser asks. On a phone, the rear camera is used when available.
2. Hold the QR code in front of the camera, flat and well lit, filling about a third of the picture.
3. As soon as a code is recognized, the result appears and the camera stops. Tick Keep scanning after a code is found to read several codes in a row: each new code is added to Recent scans. Press Stop camera when you are done.

What the tool recognizes

A QR code only stores text. Apps agree on a few formats so that phones know what to do with it, and this tool explains them in the Details table:

• Web address (URL): a link starting with http:// or https://, or www..
• Wi-Fi network: WIFI:T:WPA;S:name;P:password;;. The tool shows the network name (SSID), password, security type and whether the network is hidden, so you can type the password on a laptop that has no camera.
• Email: mailto: links and the older MATMSG: format, with recipient, subject and message.
• Phone number (tel:) and SMS (SMSTO: or sms:), with the pre-filled message.
• Contact card (vCard): BEGIN:VCARD or MECARD:, with name, organization, phone, email, website and address.
• Location: geo: coordinates (latitude and longitude).
• Text: anything else, shown exactly as it was encoded.

Safety: links are never opened

QR codes are a popular way to hide a malicious link, because you cannot read the address before scanning. Fake stickers are glued over genuine codes on parking meters, restaurant tables and posters, and emails carry QR codes that bypass link filters. This attack is called quishing (QR phishing).

This tool therefore never opens anything. The decoded text is displayed as plain text, not as a clickable link. When it is a web address, a reminder asks you to check the domain before you paste it into your browser, and the tool looks for common red flags:

• the link uses http instead of https;
• the domain is written in punycode (xn--), which can imitate a known brand with look-alike letters from another alphabet;
• the link points to a bare IP address instead of a domain name;
• it goes through a link shortener (bit.ly, tinyurl.com…), which hides the real destination;
• it contains an @ before the domain, a trick that makes https://yourbank.com@evil.example look legitimate while it actually leads to evil.example;
• it is not a web link at all but another scheme, such as javascript: or an app link.

No warning does not mean the link is safe. Read the domain name from right to left up to the first single slash: that is the site you would visit.

Privacy

Images are decoded in your browser with the open-source jsQR library, and camera frames are analyzed locally without being recorded. Nothing is uploaded, and the camera turns off when you press Stop camera, when a code is found (unless you keep scanning) or when you leave the page.