QR Code Scanner
Read a QR code with your camera, or open one from a photo already on this device. Decoding happens in your browser, so neither the image nor the contents of the code are uploaded.
Nothing is being captured yet.
It reads the contents, not just the shape
Decoding happens on a canvas in the page, and the result is the actual payload rather than a picture of a code. A link code gives you the address, a wifi code gives you the network details, a contact code gives you the contact. A wifi code in particular is handled specially, so that scanning it can offer to join the network rather than just displaying a wall of text.
Two ways in
The camera is the obvious route, but the option to choose a picture from disk is always available and works even where the camera is not. That is the practical way to read a code that arrived in a message or is printed in a document: screenshot it, or photograph it, and open the picture here.
Images are shrunk to a 640 pixel edge before decoding, which is why a large photograph of a code works perfectly well. It also means a small code photographed from far away, or printed small enough that each module is only a pixel or two across, may not be readable however sharp the photograph is. Get closer rather than sending a better camera.
Nothing is uploaded
No frame from the camera and no picture you choose leaves the page. The decoding is done in the browser, which is also why the tool keeps working when the page is offline once loaded. The camera permission prompt comes from your browser, and declining it costs you only the camera option.
Nothing executes when you scan
A QR code is text. Scanning one cannot install anything, read your files, or start a payment. The only thing that happens is that the page offers to do something with the text it found, and you decide whether to accept.
A code is a link, not a promise
This is the part worth being careful about. A code tells you where something points; it does not tell you who put it there, when, or whether the destination is still the one it was. Stickers are put up over pre-existing ones all the time, so a code you scan can lead somewhere the original poster’s owner would not expect.
Before typing a password, a card number or a code from an authenticator into anything you reached this way, read the domain out loud and check it is the one you intended. A shortened address in the code hides the real destination, which is the single most useful thing to notice.
No account and no record
There is no sign-in, nothing is stored, and nothing is sent anywhere, so there is no history of what you scanned. The same is true of the captured frames: they belong to the open page and go when you clear it, reload, or close the tab.
Why the camera option may not appear
Browsers only hand out camera access on a secure origin, which in practice means an https:// address. On a page served over plain http the camera is unavailable by design, and the tool says so rather than failing quietly. Choosing an image still works in that situation, which is also the answer on a desktop with no webcam at all.
Camera access also needs your permission. If you decline it, nothing is recorded and the file option remains available.
Reading a code from a photo
Choosing an image decodes it on the spot, with no upload. A photo of a code has to survive being photographed: the finder patterns at the three corners need to be intact and unblurred, and the code needs enough resolution in the file. A straight-on, well-lit photo of a printed code reads reliably; a small, angled, low-contrast snapshot often does not.
If a photo will not decode, cropping tighter around the code and increasing the contrast usually makes the difference.
What happens with what you scan
- Web addresses are shown as a link you can open. Nothing is opened automatically.
- Email codes offer a compose link with the recipient filled in.
- Wi-Fi codes have their password masked. The password is never displayed, because a QR code containing one should be treated as a secret in its own right.
- Anything else is shown as plain text with a copy button.
Scanning only reveals what a code contains. It does not verify where a link goes or who sent it, so treat an unexpected code the same way you would treat an unexpected email: with suspicion.