QR code reader

A QR code is an opaque link

Nothing about a printed square tells you where it goes. That is convenient, and it is the entire basis of quishing — QR phishing — where a sticker over a real code on a parking meter, a restaurant table or a charging point sends people to a payment page that is not the right one.

So this decodes and shows the contents. Nothing is opened automatically, and the host is called out separately, because the host is the only part of a URL worth reading before you trust it. A long path is exactly how a phishing link distracts from a wrong domain.

If a code you scanned in the street asks for payment details, that is the moment to stop and look at what you actually scanned.

Photographed codes, not rendered ones

The real input is a photograph: taken at an angle, with glare, with the moiré you get from photographing a screen. Decoding relies on the platform’s own BarcodeDetector, which handles those cases far better than anything small enough to fit in a page.

If a code will not read, a straighter and closer photo is almost always the fix. QR codes carry error correction — up to 30% of the pattern can be missing — so a partly damaged code usually still works.

Wi-Fi codes

A WIFI: code carries the network name, the security type and the password in plain text, so the password is shown here as text.

Worth knowing in both directions: a QR code on a café wall is not a secret, and if you have printed one for a guest network, anybody who photographs it has the password permanently.

Camera and files

The camera runs entirely in the page; frames are examined and discarded, and nothing is recorded or sent. Choosing a file works the same way.

If the camera is unavailable, a photo from your library works just as well.

Nothing is uploaded

Decoded in this page. See the QR generator for the other direction.