QR Code Reader
Decode QR codes from an image, a drag-and-drop file, or your webcam.
Drop a file here, or
PNG, JPEG, WebP, SVG… up to 20 MB — decoded locally, never uploaded.
How QR Code Reader works
Decoding reverses the encoding process. The image is first converted to greyscale and binarised — each pixel is classified black or white against a locally adaptive threshold, which is what lets the decoder cope with uneven lighting and shadows across the frame.
The decoder then hunts for the three finder patterns: the concentric squares in the top-left, top-right, and bottom-left corners, whose 1:1:3:1:1 ratio of dark and light runs is deliberately rare in natural images. Those three points fix the code’s orientation and rotation, and the smaller alignment patterns correct for perspective distortion when the code is photographed at an angle.
With the grid mapped, the modules are sampled back into a bit stream, the mask is removed, and Reed–Solomon decoding both detects and repairs damaged codewords. If enough of the redundancy survives, a scratched or partly obscured code still yields the exact original bytes — there is no partial or approximate result, it either decodes correctly or fails.
This tool reads from three sources: an uploaded image file, a drag-and-dropped file, or a live webcam stream. All three are processed locally with a WebAssembly decoder, so the image never leaves your machine and no camera frames are transmitted.
How to use this reader
Choose an input
Drop an image file onto the page, pick one with the file browser, or start the webcam to scan a physical code.
Frame the code
If using the webcam, fill roughly half the frame with the code and hold steady — the decoder samples continuously until it gets a clean read.
Read the decoded payload
The raw text appears as soon as decoding succeeds, including structured prefixes such as http://, WIFI:, or otpauth://.
Copy or inspect
Copy the payload to the clipboard. Inspect the full URL before opening it, rather than following a scanned link blindly.
Worked examples
Recovering a 2FA secret
- Given
- A screenshot of an authenticator enrolment QR code
- Result
- otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
The secret parameter is the Base32 seed. Paste it straight into the TOTP Generator to verify codes before you delete the screenshot.
Checking a suspicious sticker
- Given
- A photo of a QR code stuck on a parking meter
- Result
- https://pay-meter-verify.example.net/session?id=8842
Reading the URL as text before opening it is the whole point: quishing attacks rely on you scanning with a phone that opens the link immediately.
Reading a damaged label
- Given
- A warehouse label with a torn corner, at error-correction level H
- Result
- ASSET-2026-00417
Reed–Solomon repaired the missing codewords. Had the tear crossed a finder pattern instead, no amount of redundancy would have helped.
When to use it
- Reading a QR code from a screenshot or PDF on a desktop, where you have no phone camera pointed at the screen.
- Inspecting the destination of an untrusted code before visiting it — the defence against "quishing" phishing stickers.
- Extracting the shared secret from an authenticator enrolment code to back it up or migrate it.
- Bulk-verifying that printed labels decoded to the values you expect before a production run ships.
- Recovering the Wi-Fi password from a code printed on a router or a guest card.
Things to watch out for
- A code that fails to decode is usually a framing problem, not a data problem: too little contrast, a cropped quiet zone, motion blur, or too steep an angle.
- Webcam access requires a secure context (HTTPS) and an explicit browser permission prompt. Denying it leaves file upload fully functional.
- Never act on a scanned URL without reading it. Look at the registrable domain, not the path — attackers rely on a legitimate-looking path under a lookalike host.
- Decoding returns raw bytes interpreted as text. A code containing binary data may show replacement characters; that is the payload, not a decoder bug.
Frequently asked questions
Are my images or camera frames uploaded anywhere?
No. Both file decoding and webcam decoding run entirely in your browser. No frame, file, or decoded payload is transmitted, which is what makes this safe for authenticator secrets and Wi-Fi passwords.
Why will my code not scan?
In order of likelihood: the quiet zone (the blank margin) has been cropped, contrast is too low, the image is blurred or too small, or a finder pattern in one of the three corners is damaged. Try a higher-resolution scan of the same code first.
Can it read barcodes other than QR?
No. This decoder targets the QR specification specifically. Linear formats such as EAN-13, Code 128, and UPC encode data as bar widths along a single axis rather than as a module grid, and they carry no finder patterns, so they need an entirely different decoder. Data Matrix and Aztec are also two-dimensional but use their own distinct layouts.
Does it work without an internet connection?
Yes. The decoder is a WebAssembly module cached by the service worker along with the rest of the page, so once you have loaded the site once it keeps working with no network at all. That applies to file decoding and webcam decoding alike, since neither ever contacted a server in the first place.
Is it safe to scan a QR code from a poster or sticker?
Scanning is safe; following the link blindly is not. Decoding here shows you the destination as plain text so you can check the domain first — a phone camera that opens the URL immediately gives you no such chance.
Related Developers tools
All developer tools- TOTP Generator Turn an authenticator secret or otpauth QR code into live one-time passwords, with a 30-second countdown and one-click copy.
- Text Scrambler Shuffle characters or words with a reproducible seed and adjustable intensity.
- JWT Generator Build and sign HS256 JSON Web Tokens from a header, payload, and secret.
- JWT Decoder Inspect a token’s header and payload, with optional signature verification.
- Base64 Encode / Decode Encode and decode Base64 for text and files, with URL-safe support.
- Encrypt / Decrypt Text Encrypt and decrypt text with a passphrase (AES-GCM/CBC) or an RSA public key — output as Base64.