QR Code Scanner
Upload a QR image, paste one from your clipboard, or point your camera at a code to see what it contains. It reads website links, Wi-Fi details, contact cards, or plain text — decoded on your device, nothing uploaded.
Drop a QR image here, paste from clipboard, or use your camera
Your image is decoded entirely in this browser tab. Nothing is uploaded — the page has no server to send it to.
How QR codes encode data, and how this scanner reads them
A QR code (Quick Response code, standardized as ISO/IEC 18004) is a two-dimensional matrix barcode that stores up to 4,296 alphanumeric characters or 2,953 raw bytes, depending on the symbol version (there are 40 sizes, from 21×21 to 177×177 modules) and the error-correction level. Data is packed in one of four modes — numeric (10 bits per 3 digits), alphanumeric (11 bits per 2 characters), byte (8 bits each) or Kanji — then protected by Reed–Solomon error correction over GF(256), which is why a code still scans with a coffee ring on it or a logo stamped in the middle. Finder patterns in three corners, timing patterns and alignment markers let the decoder locate and un-distort the symbol even in a tilted phone photo.
From pixels to text: the decode pipeline
When you upload an image or grant camera access, the page runs a fully local pipeline:
- Capture. Uploaded files are drawn to an offscreen canvas (downscaled to a 1600 px ceiling — jsQR is linear in pixel count, and a 12-megapixel photo gains no accuracy while costing seconds). Camera frames are sampled twice per second from the video element.
- Binarize. jsQR converts the frame to grayscale, applies adaptive thresholding to separate dark modules from light ones under uneven lighting, and attempts both normal and inverted polarities (
inversionAttempts: "attemptBoth") so white-on-black codes scan too. - Locate. The three finder patterns are detected by their 1:1:3:1:1 run-length signature, which is rotation-invariant — the code can be upside down or sideways.
- Sample & correct. Modules are sampled on the perspective-corrected grid, Reed–Solomon erasures are repaired, and the bit stream is unpacked according to the mode indicators into the final text.
What the text means: payload conventions
A QR code is only bytes — the meaning comes from conventions layered on the text, and the scanner recognizes the important ones:
- URLs (
https://…, or barewww.…with the scheme added) become clickable links that open in a new tab withrel="noopener". - Wi-Fi (
WIFI:T:WPA;S:MyNet;P:secret;;) is parsed into SSID, password, security type and hidden flag, with backslash-escaped characters unescaped per the spec. - vCards (
BEGIN:VCARD…END:VCARD) expose name, phone, email and organization fields. - MATMSG / mailto, SMSTO / sms:, tel: and geo: payloads are detected and offered as actions.
A caution worth repeating: a QR code is an opaque pointer. Scanning a code from an untrusted source can open a phishing URL — the scanner shows you the decoded text before any link is opened, which is precisely the safety property a camera app that auto-opens links lacks.
Privacy by architecture
Server-side QR scanners receive your image — and with it, whatever the code contains. Wi-Fi passwords, TOTP provisioning URIs, payment strings and private document links are exactly the things people point cameras at. This page inverts that: the decoder (jsQR) ships as part of the page bundle, the canvas never leaves the tab, and the camera stream is stopped and its tracks released the moment you navigate away or press Stop. Verify it yourself in DevTools: scanning produces zero network requests.
Which keyboard shortcuts does the QR scanner support?
Frequently asked questions
Is my QR image uploaded to a server when I scan it?
No. The image is decoded entirely inside your browser tab using the jsQR library compiled into the page. Open your browser's Network panel while scanning: no image data leaves your device, because the page has no server endpoint to send it to. This matters because QR codes routinely encode Wi-Fi passwords, payment strings and private URLs.
What kinds of QR content are recognized?
The scanner classifies every decoded payload: website URLs (made clickable, with the scheme added when missing), Wi-Fi network credentials (SSID, password, security type and hidden flag shown in a structured card), vCard contact cards (name, phone, email, organization), email addresses and mailto links, SMS and tel: links, geo: map coordinates, and plain text. Anything else falls back to a clean monospace view with one-click copy.
Why does the camera need permission, and what if I deny it?
Live camera scanning uses the getUserMedia API, which browsers gate behind an explicit permission prompt — the page cannot access your camera silently. If you deny it, everything else keeps working: you can upload a photo of the QR code or paste a screenshot from your clipboard instead.
The QR code won't scan — how do I get a better read?
Four things fix nearly every failure: fill the frame with the code (at least a third of the image width), shoot in good light without glare or shadows across the symbol, hold the camera steady until the auto-scan fires (it samples twice per second), and make sure the quiet zone — the white margin around the code — is fully visible and not cropped.
Can it scan barcodes too, or only QR codes?
Only QR codes (the square 2D matrix symbols defined by ISO/IEC 18004). Linear barcodes like UPC, EAN and Code 128 use entirely different symbologies. For those, use the dedicated Barcode Generator page's companion tooling, or a barcode-specific scanner.
Does scanning work offline?
Yes, once the page has loaded. The jsQR decoder is bundled with the page's JavaScript, so after the first visit the scan of an uploaded image works with no network at all. Camera scanning likewise needs no network — the only permission involved is the camera itself.