QR Code Scanner

This QR code scanner reads QR codes from an image file, a pasted screenshot or your device's camera, and shows exactly what each code contains before you act on it. It is for anyone who has a QR code on a screen rather than on paper — in a screenshot, an email, a PDF you captured, a photo — and for anyone who wants to check where a code leads before opening it.

Decoding is done by jsQR, an open-source JavaScript QR reader, running in your browser. A single attempt often fails on real images, so the scanner works through a fixed plan, cheapest first: an 800-pixel version of large images, which also smooths out photo grain; the image at up to 1,600 pixels on its long side; a full-detail pass (up to 6 megapixels) for bigger images, so a small code in a big screenshot keeps its pixels; a 2× enlargement of tiny images; a contrast-boosted pass for faded or grey-on-grey codes; and finally a sweep of overlapping tiles. The scan runs in a background worker, so the page stays responsive, and it has a budget of about 4 seconds: a step that would overrun it is skipped, so an image with no code gives up within a few seconds and tells you which steps it tried. You can cancel a scan at any time. Every pass looks for both normal and inverted (light-on-dark) codes, and rotated codes are handled by the decoder itself. With "Find several codes in one image" ticked, each code found is blanked out and the image searched again, so up to four separate codes are reported, each outlined on a preview.

The decoded text is then classified. Website links show the domain first and the full address below it, with warnings when the link hides its real destination — an "@" before the domain, a link shortener, a bare IP address, an international (xn--) domain that may imitate a real one, or plain http. Links are never opened automatically; you choose "Open link". Wi-Fi codes (WIFI:…) are split into network name, security type and password; contact cards (vCard and MECARD), email, phone, SMS, map locations, calendar events and two-factor (otpauth) setup keys are broken into labelled fields, each with its own Copy button. Links for other apps, such as payment or app-store links, are shown as text only.

Use the camera button on a phone or laptop to scan a code in front of you. The camera starts only when you press it, prefers the rear camera, checks a frame about every 200 milliseconds, and switches off as soon as a code is read, when you press Stop camera, or when you leave the page. The browser asks for permission first, and camera access needs a secure (https) page.

Nothing is uploaded. The image is decoded on a canvas in your browser and the camera video never leaves your device; you can check in your browser's developer tools (Network tab) that no request carries your image. That matters because QR codes often hold Wi-Fi passwords, contact details and login links.

1. The file's first bytes are checked to confirm it is a PNG, JPG, WebP, GIF, BMP, AVIF, HEIC or SVG image, and its size against the 50 MB limit, before it is read. 2. The browser decodes the image (HEIC through a bundled decoder) and draws it on a white background, so a code on a transparent PNG is not lost against black. Images larger than 4,096 px or 16 megapixels are scaled down to fit. 3. Decode passes run in order until one succeeds: fitted to 800 px (if over 1,000 px); fitted to 1,600 px; full detail capped at 6 MP (if over 1,600 px); enlarged 2× (if under 400 px); a contrast-stretched pass; then overlapping tiles (9 half-size and 25 third-size windows of the image fitted to 1,200 px). Each pass tries normal and inverted colours. The scan runs in a Web Worker within a budget of about 4 seconds and 40 megapixels of decoding; the speed of the first decode is used to skip any later step predicted to overrun, and the result says when the scan stopped early. 4. With "Find several codes" on, each found code is painted over and the search repeats, up to 4 codes. 5. Text that is not valid UTF-8 is read as ISO-8859-1, the QR default character set. 6. The text is classified (link, Wi-Fi, contact, email, phone, SMS, location, event, 2FA key, app link or plain text) and split into fields; link warnings are added for hidden or suspicious destinations.