QR Code Scanner

Q: Is my camera feed or image uploaded anywhere?

No. Frames are drawn to a canvas and decoded in the page itself, and a chosen image file never leaves your device either. There is no server involved at any point in reading a code, nothing is stored, and the camera is stopped the moment a code is found rather than left running. You can verify this by scanning with your network connection off.

Q: Why does the camera not start?

Three usual causes, and the tool distinguishes between them. Browsers only allow camera access over HTTPS, so an insecure page cannot start one at all. Permission may have been denied, in which case the camera icon in your address bar lets you re-allow it. Or another application or tab already holds the camera, which means closing that first. In every case the image-file option still works.

Q: What makes a scanned QR code dangerous?

That you cannot see where it goes. Attackers exploit this by putting stickers over real codes on parking meters, restaurant tables and EV chargers, or by mailing codes that lead to convincing clones of bank and delivery sites. The techniques are consistent enough to detect: look-alike domains using non-Latin characters, a familiar brand name buried in a subdomain of a domain someone else owns, credentials embedded before the host, or a scheme that executes code rather than opening a page. This tool checks for all of those and shows you the real destination.

Q: Can it read more than one code in an image?

Yes, and it looks for them deliberately. A screenshot of a comparison article or a sheet of event tickets can hold several codes, and returning whichever one the decoder happened to hit first would hide the rest. The tool sweeps progressively finer overlapping regions of the image, then offers you every code it found with each one's type labelled.

Q: Does a clean result mean the code is safe?

No, and it is important to be clear about that. The analysis detects known deception patterns — it cannot tell you whether an ordinary-looking domain is run by criminals, because nothing about the link itself reveals that. Treat a clean result as 'none of the usual tricks are present', not as an endorsement. Apply the same judgement you would to any link: be sceptical of anything unexpected that asks for a login or a payment.

Q: Why will it not let me open some codes?

Because some schemes execute rather than navigate. A javascript: or data: URL in a QR code has no legitimate use and can run code or embed a payload, so those are never turned into a clickable link — the decoded text is still shown in full so you can see exactly what it was. Payloads that are not links at all, like Wi-Fi definitions and contact cards, are also shown as text rather than actioned, so nothing happens without you choosing it.

Scan a QR code with your camera or from an image, and see where it goes before you open it.

You can also drag an image here, or paste a screenshot with Ctrl+V. Nothing is uploaded — decoding happens in your browser.

Already have the decoded text?

Runs the same safety analysis without needing the code itself.

What It Does

This tool reads a QR code from your camera, an image file, a dragged screenshot or a pasted one, and then does the thing that actually matters: it tells you what the code contains and what following it would do, before you follow it. A QR code is opaque by design — you cannot see the destination by looking at it — and that opacity is exactly what QR phishing relies on. Everything happens in your browser; no image and no decoded value is ever sent to a server.

When to Use It

You have been sent a QR code image and want to know where it leads without pointing your phone at it.
You found a code stuck over the original on a parking meter or restaurant table and want to check it before paying anything.
You are on a laptop with the code on screen, and photographing your own monitor with a phone is absurd.
You are verifying a code you generated yourself, to confirm it encodes what you intended before printing it.

Worked Examples

A brand name hidden in a subdomain

Reads as PayPal at a glance. The site is actually owned by example-verify.xyz — everything before that is a subdomain the attacker chose freely. The analysis names the real owner, which is the only part that cannot be faked.

A punycode look-alike domain

This renders in the address bar as a word that looks like a familiar brand, using a non-Latin character that is visually identical to a Latin one. Flagged as a homograph, because reading the rendered name cannot tell you apart from the real thing.

An executable scheme

Blocked outright and never made clickable. A QR code containing javascript: has no legitimate purpose — the decoded text is still shown in full so you can see exactly what it was.

An open Wi-Fi network

Not a link at all, so nothing is opened. The analysis identifies it as a Wi-Fi join and flags that the network is unencrypted — which is what makes a code like this worth being sceptical about in a public place.

Common Mistakes

Trusting a code because of where it is displayed. Stickers placed over legitimate codes on parking meters, menus and charging points are a well-documented scam. The physical setting tells you nothing about the destination — the decoded link does.
Following a shortened link from a code without thinking. A shortener hides the real destination behind a domain you cannot evaluate, which is a reasonable thing on a poster and a red flag on anything asking for money or a login.
Ignoring the domain because the page looks right. A convincing clone of a bank or delivery page is easy to build; the domain is the part that cannot be faked. This tool shows you the actual host and flags the subdomain tricks used to disguise it.
Assuming a QR code can only contain a link. Codes can carry Wi-Fi joins, contact cards, calendar entries, SMS drafts, phone numbers and payment requests — some of which act with a single tap. The analysis names the type so nothing acts unexpectedly.
Scanning a blurry photo and concluding the code is broken. Small codes inside large photos often fail on the first pass; this tool automatically retries at double size, but a sharp, close crop still reads far more reliably.

Features

Camera scanning with a rear-camera preference and multi-camera picker

Image file

drag-and-drop and clipboard paste

Finds every code in an image

not just the first

Phishing analysis on the decoded link

Blocks javascript:

data: and other executable schemes from becoming clickable

Detects punycode and mixed-alphabet look-alike domains

Flags brand names hidden in subdomains

Identifies Wi-Fi

contact

calendar

SMS and payment payloads

Uses the browser's native detector where available

Camera stops the moment a code is found

Nothing uploaded — decoding runs in your browser

How to Use

1. Click 'Scan with camera' and allow camera access, or choose an image file. 2. You can also drag an image onto the panel, or paste a screenshot with Ctrl+V. 3. Hold the code steady in the frame — the camera stops automatically once a code is read. 4. Read the analysis before doing anything: check the destination host and any warnings. 5. Use 'Open the link' only if the analysis raises nothing you are not comfortable with.

Frequently Asked Questions

Is my camera feed or image uploaded anywhere?

Why does the camera not start?

What makes a scanned QR code dangerous?

Can it read more than one code in an image?

Does a clean result mean the code is safe?

Why will it not let me open some codes?

Everything runs in your browser. Camera frames and chosen images are decoded in the page and never uploaded, nothing is stored, and the camera is switched off as soon as a code is found. Camera access requires a secure (HTTPS) connection — on an insecure page the image-file option still works. The safety analysis uses pattern-based heuristics and cannot guarantee a destination is safe; it flags known deception techniques, and a clean result is not a guarantee. Decoding uses the browser's built-in detector where available, otherwise the bundled jsQR library (Apache-2.0).