QR Code Reader — Image and Camera Scanner

Choose a PNG, JPEG, WebP or GIF image, drag it into the reader, or select Use the camera and then Start camera. The tool decodes a QR code and displays its content before you decide what to do with it. It does not automatically open links, connect to Wi-Fi, add contacts or send messages.

Scanning runs in your browser. QR content, selected images and camera footage are not sent to this tool’s server. Opening a decoded link does make a separate request to that destination. A decoded code is not a safety certificate: check the destination host and the context in which you received it.

The camera stops after a code is found. Select Scan another code to restart it. You can stop the camera or cancel a pending start. The camera also stops when the page becomes hidden. For an image, use Scan another image to clear the result.

No known warning patterns found means that the registered checks did not find a match. It does not mean the content, website or operator is trustworthy. An HTTPS link can still lead to a phishing site. This tool does not visit destinations, follow redirects or consult a malware reputation database.

Only an HTTPS URL with no registered warnings receives an Open HTTPS link in a new tab button. Warning-bearing URLs remain text. Other content, including contact and Wi-Fi data, is never turned into an action link. Copying content does not make it safe to paste into another app.

• High-risk patterns: javascript:, data:, vbscript: and file: URIs; username/password-style URL sections such as https://trusted.example@destination.example/; bidirectional text controls; and selected mixed-script domain patterns.
• URL warnings: unencrypted HTTP, direct IP addresses, localhost or local-looking hostnames, nonstandard ports, noncanonical URL syntax, line breaks or tabs, Punycode internationalized names, and registered URL shorteners.
• Action formats: phone, SMS/MMS, email, Wi-Fi, location, Android intents and recognized non-HTTP(S) URI schemes are flagged because other apps may interpret them as actions.
• Embedded URLs: recognized URLTO/MEBKM wrappers and URL fields in vCard/MECARD contacts receive the same registered checks. A destination is shown when exactly one URL is extracted from the structured data.

IP addresses and internationalized names also have legitimate uses. Warnings call for verification; they are not proof of fraud. The checks do not recognize every possible URI format, shortener or lookalike name.

These are illustrative data strings, not live credentials. Never share a real Wi-Fi password or authenticator enrollment code just to test a reader. Standard vCard, mailto:, WIFI: and DPP: data can also be displayed.

• Files must be 12 MiB (12,582,912 bytes) or smaller. The longest image edge must not exceed 8,192 pixels, and the total must not exceed 33,554,432 pixels.
• The file header is checked before decoding. A misleading extension or MIME type does not make an unsupported file valid. SVG, PDF and HEIC are not accepted; export a supported image first.
• Images are scaled to at most 2,048 pixels per edge and 4,194,304 pixels for decoding. Small codes in large images can become unreadable after scaling. Crop to the intended code while keeping its surrounding white margin.
• A supported BarcodeDetector implementation is tried first. If unavailable, unsuccessful or unresponsive, jsQR is used. Analysis normally uses a Worker; if that fails, a smaller image of at most 1,048,576 pixels is processed on the main thread.
• The file-reading pipeline has a 12-second deadline, with shorter budgets for individual decoding methods. Browser-native operations and synchronous work cannot always be interrupted immediately.
• The reader displays one decoded result at a time. It is not a batch scanner or a linear-barcode reader. Place one intended QR code in the image or camera view.

Decoded content is rendered as text, not executed as HTML. C0 control characters other than tab, line feed and carriage return, plus U+007F and bidirectional controls, are removed from displayed and copied text. Registered invisible formatting characters that affect a URL or scheme interpretation are also removed, with a warning.

Ordinary text retains joining characters such as ZWJ in emoji. Other registered invisible formatting characters in ordinary text are preserved but flagged. In recognized URIs, percent-encoding checks cover registered bidirectional controls and invisible formatting characters, not every encoded control character. The original content remains encoded for copying. The Copy decoded content button copies the displayed text, which may differ from the original payload after these removals.

Local processing describes this tool’s implementation. It does not guarantee the behavior of your device, browser extensions or websites you choose to open. Review the site’s Privacy Policy and Disclaimer for the broader terms of use.

The FBI/IC3 warned in January 2022 about QR-code tampering that redirects people to malicious destinations. The FTC’s December 2023 consumer alert describes misleading QR codes placed over legitimate ones or sent in unexpected messages.

Inspect the decoded host for spelling changes and misleading characters. If a code asks you to sign in, pay or act urgently, verify the request through a website or contact method you already trust. A familiar logo on a printed code and an HTTPS address alone do not establish legitimacy.