QR Code Reader — Scan QR from Image or Camera (Free)

Decode Before You Follow: Why Reading a QR Code First Is a Real Security Step

A printed QR code is opaque. You cannot see where it points until you scan it, which is exactly why sticker-over-sticker attacks work. A malicious actor prints a new code over an existing one on a parking meter, restaurant menu, or product tag, and the next person to scan it lands on a phishing site or malware distribution page instead of the legitimate destination. The only defence is to decode the payload to plain text first, on a tool that does NOT auto-navigate, and read the destination before deciding whether to follow it. This reader displays the full decoded text in a monospace box where you can inspect every character. Nothing is opened automatically, and the "Open link" button appears only when the payload actually begins with http:// or https://—a payload using any other scheme is shown as text you can read, never as something clickable.

What to Look For in a Decoded QR Payload

A QR code encodes any text, not just URLs. After decoding, check what you actually got. A legitimate URL points to the domain you expected—verify the hostname character by character against what you typed manually if you are uncertain. Lookalike domains are the usual trick: a swapped character such as rnicrosoft.com for microsoft.com, where rn reads as m at a glance, or a different top-level domain on an otherwise familiar name. Read the hostname right-to-left from the final slash, since the real domain is the last two labels before it—paypal.com.verify-login.example is on example, not PayPal. A shortened URL hides the real destination entirely, so a code that decodes to a shortener tells you nothing about where it leads; a link-expander service will resolve it without your browser following it. Non-URL payloads—Wi-Fi credentials in WPA format, payment strings, pre-filled SMS text—decode as plain text and display fully, so you can see exactly what data the code is asking you to exchange before you commit to it.

Why a QR Code Fails to Scan and How to Fix It

The reader tells you immediately if no QR code is detected in an image or camera frame. The most common causes are: low contrast, where a light-grey code on white fails in poor lighting, missing or damaged quiet zone, the blank margin at least four modules wide on every side (code touching artwork, text, or cropped edges disrupts detection), blur from camera motion or focus drift, excessive angle (point straight, not at an acute angle), or damage beyond error correction. To troubleshoot: crop the image tighter to isolate the code, straighten your camera position if using live scanning, ensure your device's flashlight is on in poor lighting, or increase the image contrast if the code is faded. Inverted codes are not a problem—the reader attempts both normal and inverted polarity on every image, so white-on-black codes decode as readily as black-on-white.

What This Reader Actually Does and Does Not Do

The reader handles two input modes: upload an image file (PNG, JPG, WebP, or any format your browser can decode) or use your camera in real time. Both run entirely in your browser—the image is drawn to a canvas and decoded from the pixel data locally, so no QR code, photo, or decoded text is ever sent to a server. If an image contains multiple codes, the reader returns the first one detected; to read the others, crop them out and upload separately. The camera option is hidden automatically when the browser cannot offer it, which includes any page not served over HTTPS as well as older desktop browsers. Decoding uses jsQR, a widely deployed open-source library, and all standard QR versions and error-correction levels are supported.

Reading a code is the other half of making one, and checking what you generated actually scans is worth doing before it goes to print. The QR generator is the other direction.