QR Code Reader
Decode a QR code from an image or your camera and read the destination before you visit it.
Processed on your device — no upload
The video never leaves this page — no frame is uploaded, and scanning stops the moment a code is found.
How to use it
- Choose an image, or open the camera.
- Read what the code actually says.
- Then decide whether to follow it.
How it works
The image is drawn onto a canvas in this page and the pixels are searched for the three large squares that mark a QR code's corners. Once those are located the grid is read, the error correction is applied, and the text falls out. No frame and no file leaves your device — the camera stream is read and discarded in the same tick.
Your phone's own camera does this too. The difference is what happens next. A phone shows you a shortened preview and a button that opens the link. This page shows the whole thing, takes it apart, and does not open anything.
What it flags. A link served over plain http. A username embedded before the host, which is the oldest trick for making an address appear to point somewhere it does not. A shortener, which hides the real destination entirely. A domain containing Cyrillic or Greek letters that look identical to Latin ones — the way a convincing fake of a bank's address gets registered. And punycode, which is what that looks like once it is encoded.
Structured codes are broken into fields: a WiFi code shows the network, the password and whether it is an open network; a contact card shows each field it will save.
A worked example
The attack this defends against has a name. Quishing — a QR code printed on a sticker and placed over a real one. Parking meters, restaurant tables, electric vehicle chargers and posted invoices are the usual targets, because in each case the victim expects to reach a payment page and has no way to tell which one they reached. The sticker costs nothing and the code is unreadable to a human by design.
How to use this in practice. Photograph the code rather than scanning it, open this page, and choose the photo. You get the full destination before anything opens. If it is a shortener when you expected your city's parking service, or the host is not the domain printed beside it, you have your answer.
A worked example of the lookalike warning. A code decodes to https://аirbnb.com/pay. It reads perfectly. The first letter is Cyrillic а, not Latin a, so it is a different domain entirely — registered, hosted and certificated by someone else. Your eye cannot separate them at any size. This page says so.
The other everyday use. Recovering the password from a WiFi code someone printed and stuck on the fridge, or reading a contact card without saving it first. Both show as plain fields here.
To go the other way and build a code, use the QR generator. To take apart a suspicious link you already have as text, the URL inspector shows every part of it.
Questions
Is the image or camera feed uploaded?
No. Decoding happens in this page. The camera stream is read frame by frame in your browser and never recorded or transmitted.
Why not just scan it with my phone?
Your phone scans it and offers to open it. This shows the whole destination and does not open anything, which is the difference that matters for a code you did not expect.
What is quishing?
Phishing using a QR code — typically a sticker placed over a legitimate code on a parking meter, a table or an invoice, sending you to a fake payment page.
The camera will not open.
It needs your permission, and browsers only allow camera access over https or on localhost. Choosing a photo works everywhere and is often easier.
It says no code was found.
Crop closer to the code and try again. Blur, glare and a steep angle defeat the decoder — a flat, sharp, well-lit photo reads reliably.
Can it read barcodes as well?
No, QR codes only. A shop barcode is a different format with a different decoder.
Is a shortened link necessarily bad?
No, they are common and usually harmless. But a shortener inside a QR code hides the destination twice over, so it is worth noting when you did not expect one.
What does the punycode warning mean?
A domain starting xn-- is a non-Latin name encoded into ASCII. Legitimate ones exist, but it also disguises a spelling that would otherwise be obviously wrong.