Loading Techie Utils…

QR Code Scanner

Read a QR code from an image, and see what it does before you follow it. Free, and runs entirely in your browser — nothing you enter is uploaded or stored.

About QR & Barcode Reader

Reads the barcodes out of an image: a photograph of a label, a screenshot of a QR code on a page, a scan of a delivery note, or an SVG. ZXing does the decoding — the same library a great many scanner apps use — compiled to WebAssembly and running in this tab, so the picture is never uploaded.

It reads what it finds rather than what it is told to expect: QR and Micro QR, Data Matrix, Aztec, PDF417 and MaxiCode, and the striped family — Code 128, Code 39, Code 93, Codabar, ITF, EAN-13, EAN-8, UPC-A, UPC-E and GS1 DataBar. Narrowing the search to one family helps when an image holds several codes and only one of them matters.

Rotated, inverted and downscaled images are all tried, because a photograph is rarely square to the label. Every symbol found is reported with its content, its symbology, its error-correction level and where it sits in the picture, and a code whose check digits disagree is flagged rather than passed off as read.

Then it reads what the code actually says. Almost nothing worth scanning is plain text — it is a URL, a WiFi credential, a contact card, a two-factor enrolment secret, a payment request — so each is parsed into its parts rather than handed back as a string. And a decoded URL is examined rather than merely displayed, because a QR code is the only kind of link nobody can read before following it. That is the whole point of the format and the whole problem with it: a sticker over the code on a parking meter works because the victim sees a square and their phone sees an address. So the scheme, the host and the spelling of the host all get checked here, against the same tests the homograph detector applies to a name typed by hand.

Where it helps

  • Reads every common symbology, two-dimensional and striped alike, without being told which to expect.
  • Parses what the code holds — WiFi, contact card, two-factor secret, payment request, calendar event — instead of returning a raw string.
  • Takes an SVG as well as a raster image, drawn large before scanning — so the file the QR generator here writes reads straight back.
  • Checks a decoded URL for the things you cannot see: a look-alike domain, credentials hiding the real host, a scheme that runs rather than opens.
  • The image stays in your browser — a boarding pass or a prescription label is not something to upload.

Limits

  • A blurred, cropped or heavily compressed photograph may not decode; the whole symbol and its quiet zone have to be in frame.
  • The safety checks catch the known tricks, not every trick. A perfectly ordinary domain can still host something hostile, and no checker can tell you that.
  • The first scan loads the decoder as WebAssembly, which takes a moment.
  • Live scanning from a camera is not offered; this reads an image you already have.

Frequently asked questions

Nothing was found — what now?

Crop to the code and try again. A photograph needs the whole symbol including its white margin, reasonably in focus; a screenshot needs the code at its original size rather than scaled down.

Is the image uploaded anywhere?

No. It is decoded and scanned in this tab, which is the reason to do it here rather than on a site that would receive the picture.

Can it scan from my camera?

Not here — this reads an image file. Take the photograph with your camera app and scan that.

Does it read SVG?

Yes. A vector has no resolution of its own, so it is drawn at about twelve hundred pixels before scanning — which matters, because a QR code written at scale 1 declares itself thirty-three pixels across and no decoder could find it at that size.

What does the flagged check digit mean?

The symbol was readable but its own checksum disagrees, so the content may be misread. Rescan from a better image before trusting it.

Why does it grade the code?

Because a code is a link you cannot read before following. The grade is what the payload does if you act on it — an ordinary https address scores full marks, a disguised host or a javascript: scheme scores nothing, and every point taken off is a line you can read underneath.

It found my WiFi password in plain text. Is that a bug?

No, that is how the format works: a WiFi QR code carries the password unencrypted, so anyone who photographs the sticker has it. Worth knowing before printing one for a guest network.

Related tools

More Images & Files tools