Read a QR code without opening it
This QR code scanner reads the code in a photo, a screenshot or your camera picture and shows you what it holds before anything happens. A web link is shown in full, with the domain it really goes to, and only opens when you press Open link. A Wi-Fi code shows the network name and password, a contact card shows the name, phone numbers and email addresses, and plain text is shown as text. Nothing is uploaded: the code is decoded on your device, by the barcode reader built into your browser or, where there is none, by the jsQR library.
That makes it handy on a computer, when someone sends you a screenshot of a code, or when you want to check where a code on a poster or a parking meter leads before you visit it. To make a code of your own, use the QR code generator. For product barcodes such as EAN-13 and UPC-A, the barcode generator draws them with the right check digit, and this scanner reads them too when you tick Also read barcodes, in browsers with a built-in barcode reader.
Check a link before you open it
A QR code is just stored text, but scammers use them to hide harmful links. The Federal Trade Commission warns that scammers put their own codes over real ones, for example on parking meters, and send codes by text or email with an urgent excuse such as a failed delivery or a problem with your account. The FBI notes that tampered codes can lead to fake sites that ask for login and payment details, and that money sent to a criminal this way may not be recoverable. Both advise you to look at the address before you open it and to watch for misspellings and lookalike domains.
The scanner helps with that check. For every web link it shows the domain in large type and flags these warning signs:
- No HTTPS. An http:// address sends everything unencrypted. Do not type passwords or card numbers there.
- Text before an @ sign. In https://yourbank.example@pay-check.example/login, the site is pay-check.example. The part before the @ is only a user name, and it can be made to look like a site you trust.
- A numeric IP address instead of a domain name.
- Letters from other alphabets. A domain label that starts with xn-- contains characters that can look like Latin letters, so a fake address can look almost the same as the real one.
No warning does not mean a site is safe. When a code asks you to log in or pay, the FTC and the FBI recommend that you go to the company's website or app the way you usually do, instead of following the code.
What the scanner recognizes
The text inside a QR code can follow a format that tells phones what to do with it. The scanner recognizes these and shows the fields in a readable form. Every field is shown as plain text, so nothing in a code can run on this page.
| Content | Starts with | What you see |
|---|---|---|
| Web link | https:// or http:// | Full address, domain, warning signs, Open link button |
| Wi-Fi network | WIFI: | Network name, security type, password with a copy button |
| Contact | BEGIN:VCARD or MECARD: | Name, organization, phones, emails, websites, address; vCards can be saved as a .vcf file |
| Calendar event | BEGIN:VEVENT or BEGIN:VCALENDAR | Title, start, end and place; can be saved as an .ics file |
| mailto: or MATMSG: | Recipients, subject and message | |
| Phone or text message | tel:, sms: or SMSTO: | Number and message |
| Location | geo: | Latitude and longitude, with a map link |
| Payment | bitcoin:, ethereum:, BCD | Address or account, amount and reference, with a warning |
| Anything else | The text itself |
The Wi-Fi and MECARD formats are described in the ZXing project's barcode contents guide: in WIFI:T:WPA;S:mynetwork;P:mypass;;, T is the security type, S the network name, P the password and H marks a hidden network, and the characters \ ; , " and : inside a value are escaped with a backslash. Contact cards follow RFC 6350 (vCard), where long lines are folded and commas, semicolons and line breaks in values are escaped. Email links follow RFC 6068, which allows several recipients separated by commas plus fields like subject and body. Locations follow RFC 5870: latitude first, then longitude, in WGS-84 decimal degrees.
Worked example
A café prints a Wi-Fi code whose text is WIFI:T:WPA;S:Corner Bakery Guest;P:croissant\;2026;;. The scanner shows:
| Type | Wi-Fi network |
| Network name | Corner Bakery Guest |
| Security | WPA/WPA2 |
| Password | croissant;2026 |
The backslash before the semicolon tells the reader that the semicolon belongs to the password and does not end the field, so the password is croissant;2026. A second code, stuck over the menu, holds http://yourbank.example@pay-check.example/login. The scanner shows the domain pay-check.example and two warnings: the link does not use HTTPS, and the part before the @ is only a user name.
Which browsers can scan here
The scanner first looks for the Barcode Detection API, a barcode reader built into some browsers, which MDN marks as experimental. According to MDN's browser compatibility data, Chrome supports it on Android, ChromeOS and macOS, Edge and Opera support it on macOS only, Safari has it behind a setting that is off by default, and Firefox does not support it.
In every other browser the page loads jsQR, an open-source QR code reader written in JavaScript (Apache-2.0 license). It is downloaded only when your browser needs it and runs on your device like the rest of the page, so the images you decode stay with you. The two readers differ in a few ways:
| Built-in reader | jsQR | |
|---|---|---|
| QR codes | Yes | Yes, including light codes on a dark background |
| Other barcodes (EAN, UPC, Code 128 and more) | Yes, with Also read barcodes | No |
| Codes per picture | All it finds | One per scan |
| Camera checks per second | About 5 | About 8, on a copy at most 1,000 pixels wide |
For large photos, jsQR tries the picture at up to 1,600 pixels and then smaller copies, which often helps with busy or noisy pictures. On a phone, the FBI notes that the built-in camera app usually reads QR codes too, so you do not need to install a separate scanner app.
The camera and your privacy
The camera starts only when you press Start camera. MDN explains that a page can reach the camera only over a secure connection and only after you give permission. On phones the scanner asks for the rear camera, and Switch camera changes to the other one. The picture is checked in your browser a few times per second; as soon as a code is found the camera turns off. It also turns off when you press Stop camera or switch to another tab. No picture is stored or sent.
How to scan a QR code
- 1Choose Image and pick a photo or screenshot, drop it on the box or paste it. Or choose Camera and press Start camera.
- 2For the camera, hold the code inside the frame until it is found. The camera then stops by itself.
- 3Read what the code holds. For a link, check the domain and any warnings before you press Open link.
- 4Press Copy text to copy the content, or use the buttons for the type, such as Copy password for a Wi-Fi code.
Sources
- FTC Consumer Advice: Scammers hide harmful links in QR codes to steal your information (December 6, 2023)
- FBI IC3 Public Service Announcement I-011822-PSA: Cybercriminals tampering with QR codes to steal victim funds (January 18, 2022)
- MDN: Barcode Detection API (experimental, supported formats, detect() input)
- MDN browser compatibility data: BarcodeDetector
- MDN: MediaDevices.getUserMedia() (secure context, permission, facingMode)
- GitHub: cozmo/jsQR, the QR code reader used in browsers without a built-in one (Apache-2.0 license)
- ZXing wiki: Barcode Contents (Wi-Fi, MECARD, SMS, geo formats)
- RFC 6350: vCard Format Specification
- RFC 6068: The 'mailto' URI Scheme
- RFC 5870: A Uniform Resource Identifier for Geographic Locations ('geo' URI)
Frequently asked questions
Is my image or camera picture uploaded?
No. The QR code is read by your browser on your device, and the image or camera picture is never sent anywhere. The camera only starts when you press Start camera, and it stops as soon as a code is found, when you press Stop camera or when you leave the tab.
Which browsers does the scanner work in?
All current browsers can read QR codes here. Where the browser has a built-in barcode reader, which MDN’s compatibility data lists for Chrome on Android, ChromeOS and macOS and for Edge and Opera on macOS, the scanner uses it. Everywhere else, including Firefox, Safari and Chrome on Windows, it loads the open-source jsQR library and reads the code with that, also on your device.
Can it read barcodes such as EAN or UPC?
Only in browsers with a built-in barcode reader. Tick Also read barcodes there. jsQR, which the scanner uses in other browsers, reads QR codes only, so the option is switched off in those browsers.
Does the scanner open links automatically?
No. It shows the full address and the domain it really goes to, flags warning signs such as a missing HTTPS or a user name before an @ sign, and only opens the link when you press Open link. Check the address first, because a QR code can lead to a phishing site.
Can it read a Wi-Fi QR code?
Yes. It shows the network name, the security type and the password, with a button to copy the password. It does not join the network for you; enter the details in your Wi-Fi settings, or scan the code with your phone’s camera app.
Can it read several QR codes in one picture?
With a built-in barcode reader, yes: every code the browser finds is listed, numbered and outlined in the preview. With jsQR, which returns one code per scan, you get one code per picture; crop the picture or cover that code to read the next one.
What if no code is found?
Use a sharper picture in which the code fills more of the frame, with the whole code and its light border visible. Avoid glare and strong angles. A screenshot of a code on a screen usually works better than a photo of the screen.