QR Code Reader
Decode a QR code from an image, screenshot or camera, and check the link before you open it.
Or copy a screenshot and press Ctrl+V (⌘+V on a Mac) anywhere on this page.
How It Works
Load an image, paste a screenshot, or point your camera at a code. The picture is drawn onto a hidden canvas and decoded by jsQR, an open-source QR decoder that runs inside the page. The result is shown as plain text. The page never opens the link, never visits it and never sends the image anywhere.
If the code holds a web address, the reader breaks it apart the same way your browser would and shows the site it actually points to. Then it checks for the tricks scammers use to make one site look like another.
Want to know more about these scams? Read how to check a QR code before you open it.
What the Link Checks Mean
| Flag | Why it matters |
|---|---|
| Text before an @ | In https://[email protected]/ everything before the @ is ignored. The browser goes to other.example. |
| Look-alike letters (xn--) | The domain uses non-Latin letters, such as a Cyrillic “а” that looks exactly like a Latin “a”. Browsers store these as xn-- names. |
| IP address | The link points at a bare number like 203.0.113.7 instead of a name. Real businesses almost never do this. |
| Link shortener | bit.ly, tinyurl.com and others hide the final address until you open them. |
| Another domain inside | paypal.com.secure-login.example belongs to secure-login.example. Only the end of the name counts. |
| http, not https | The connection is not encrypted. Never type a password or card number on such a page. |
| Very long query | Long strings after the ? can carry tracking IDs or pre-filled data. Not always bad, but worth noticing. |
No warnings does not mean safe. A scam can sit on a plain, ordinary-looking domain. The most useful question is: is this domain the one I expect from whoever put the code in front of me?
Limits
This reader decodes standard QR codes only, not Data Matrix, Aztec or 1D barcodes. Very blurry, tiny or heavily stylised codes may not decode; a sharper photo or a tighter crop usually fixes that. Camera scanning needs a browser that supports camera access on a secure (https) page. HEIC photos only open in browsers that can display HEIC, such as Safari; elsewhere convert them first with the HEIC to JPG converter.
Frequently Asked Questions
How do I read a QR code from a screenshot or photo?
Choose the image with the file picker, or copy the screenshot and press Ctrl+V (Cmd+V on a Mac) on this page. The code is decoded in your browser and its content is shown as plain text. Nothing is opened automatically.
Does this tool open the link in the QR code?
No. It only shows the decoded text and never opens, visits or fetches the link. You decide whether to copy it and open it yourself after checking the domain.
How can I tell where a QR code link really goes?
Look at the domain: the name just before the first single slash, read from the right. In https://paypal.com.account-check.example/login the site is account-check.example, not paypal.com. The reader shows that domain in large type and flags tricks like text before an @ sign, look-alike international letters, raw IP addresses and link shorteners.
If no warnings appear, is the link safe?
Not necessarily. The checks look at the link's structure only. A scam can use an ordinary-looking domain, so the real test is whether the domain is the one you expect from the business or poster in front of you.
Can it read Wi-Fi, contact and phone QR codes?
Yes. Wi-Fi codes show the network name, security type and password; contact cards (vCard and MeCard) show the name, phone, email and other fields; tel and SMS codes show the number and any message text.
Why does the camera not start?
The browser has to ask for camera permission, and it only does so on a secure page. If you blocked it earlier, allow the camera in your browser's site settings. You can always take a photo or screenshot instead and load it as an image.