📷 QR Code Scanner
Scan a QR code from your camera or an image and see exactly what it contains. Nothing is opened, joined or dialled automatically, and risky links are flagged.
Decoding happens in this tab — the camera feed and any image you choose are never uploaded. Whatever the code contains is shown to you first; nothing is opened, joined or dialled on your behalf.
What QR Code Scanner Does
A QR code is an instruction you cannot read. That is not a design flaw, it is the entire nature of the thing: a payload encoded into a pattern that means nothing to a human until a machine decodes it. Which is precisely why they became a phishing vector. A sticker placed over the real code on a parking meter, a restaurant table or a delivery notice sends people to a page they had no opportunity to inspect, and most scanners have already opened it before showing anything.
So this scanner decodes and then stops. The full address is shown, the registrable domain is displayed on its own line in large type, and opening it requires a deliberate click from you. Nothing is opened, joined, dialled or messaged automatically.
On top of that it looks at what it found. A punycode hostname can render as a familiar brand while resolving somewhere else entirely — the classic homograph attack. A link shortener hides the destination behind another layer you also cannot inspect, which on a code you already could not inspect is worth real suspicion. Credentials before an @ sign are a long-standing way to disguise which site you are actually visiting. Plain HTTP means anything you send travels unencrypted. Each of those is called out specifically rather than as a generic warning.
Wi-Fi codes get the same treatment. They carry a network name and a password, and handing those straight to the operating system is a decision worth making consciously, so the fields are shown as text with the password masked until you reveal it. Everything happens in the page: the camera stream and any image you choose are never transmitted.
How to Use QR Code Scanner
- Scan with the camera, or choose a photo containing a code
- Read what it actually contains — nothing is opened automatically
- Check the domain against the one you expected, and read any warnings
- Open the link deliberately if you are satisfied it is what you expected
What the scanner flags, and why
| Signal | Why it matters |
|---|---|
| A punycode host (xn--…) | Can display as a familiar brand name while being a different domain — the homograph trick |
| A link shortener | Hides the real destination behind another redirect you cannot inspect |
| Credentials before an @ | Long-standing way to make a URL appear to point at a site it does not |
| Plain HTTP | Anything you send travels unencrypted and can be read or altered in transit |
| An unusually long or deeply nested host | Common in addresses built to resemble a legitimate one at a glance |
What a QR code can contain
| Type | Recognised as | What this tool does |
|---|---|---|
| https://… or http://… | A web address | Shows the domain and the full URL; never opens it for you |
| WIFI:S:…;T:…;P:…; | A Wi-Fi network | Shows the name, security type and password, masked by default |
| BEGIN:VCARD | A contact card | Shows the raw card so you can see what it would add |
| mailto:, tel:, smsto:, geo: | Contact and location actions | Labelled and shown; nothing is dialled or sent |
| Anything else | Plain text | Shown as-is |
How to Read Your Result
Read the domain, not the whole URL
The registrable domain is the only part that identifies who controls the destination, and it is shown separately for exactly that reason. Everything after it — the path, the query, any subdomain — can be made to say anything at all. A long address containing a familiar brand name somewhere in the middle tells you nothing.
Be more suspicious of a code than of a link
A link in an email can at least be hovered. A code on a physical surface can be a sticker applied by anyone, and there is no visual difference between a legitimate one and a fraudulent one. Physical codes asking for payment deserve particular scepticism — check the domain against the one the business actually uses.
A Wi-Fi code is a credential
Joining a network hands traffic to whoever runs it. Seeing the network name and security type before joining tells you whether it is the one you meant and whether it is encrypted at all — an open network with no password is worth knowing about before you connect, not after.
Limitations & Accuracy Notes
- QR codes only. Other barcode symbologies — EAN, UPC, Code 128, Data Matrix, PDF417 — are not decoded.
- The camera needs permission and a reasonably sharp, roughly square-on view. A code at a steep angle or at low resolution may not decode.
- The warnings are heuristics, not a verdict. A perfectly ordinary link can use a shortener, and a malicious one can use a plain HTTPS address on a domain that looks unremarkable. Nothing here replaces judgement about whether you expected this code to point where it does.
- No history is kept between sessions, and nothing is stored.
- Codes with heavy damage or very low contrast may fail; both normal and inverted renderings are attempted.
Frequently Asked Questions
Why does it not just open the link?
What does it warn about?
Can it read a Wi-Fi QR code?
It cannot find the code in my photo.
Does the camera feed go anywhere?
Which other formats does it read?
References & Further Reading
- jsQR — The Apache-2.0 decoder running in your browser
- MDN — MediaDevices.getUserMedia() — How the camera is accessed, and why it requires explicit permission
- MDN — URL — The parser used to separate the host from the rest of the address before it is shown to you