QR Code Scanner

This free QR code scanner reads QR codes and 12 barcode symbologies (Aztec, Data Matrix, PDF417, Code 128/39/93, EAN, UPC, ITF, Codabar) from your camera, an uploaded image, a pasted screenshot or a PDF — entirely in your browser, with nothing uploaded. It automatically classifies results into URLs, WiFi credentials, contacts (vCard/MeCard), UPI/crypto/PayPal/SEPA payments, calendar events, geo-locations, email, phone, SMS, WhatsApp, 2FA secrets and more, and runs a phishing/security analysis on any link it finds.

What is a QR code and how does it work?

A QR code (“Quick Response” code) is a two-dimensional barcode invented by Denso Wave in 1994. Unlike a traditional 1D barcode, which stores a small number along a single horizontal line, a QR code packs data into a grid of black and white squares called modules, encoding information both horizontally and vertically. That two-dimensional layout lets a single QR code hold up to about 3 KB of data — roughly 7,089 digits or 4,296 alphanumeric characters — which is why the same little square can carry a website link, a WiFi password, a payment request or an entire contact card.

Every QR code shares a fixed anatomy that makes it fast and reliable to read. The three large squares in the corners are finder patterns that tell a scanner where the code is and how it is rotated, so it can be read from any angle. Smaller alignment and timing patterns keep the grid square even when the code is printed on a curved surface or photographed at a slant. A quiet zone — the blank margin around the code — separates it from surrounding artwork, and format and version information around the finders tells the decoder which error-correction level and size were used.

When you scan a QR code, the camera captures the pattern, the decoder locates the finder patterns, samples the grid into a matrix of light and dark modules, and then reverses the Reed–Solomon error-correction and masking to recover the original bytes. Those bytes are interpreted as text following well-known conventions — a string beginning with “https://” is a link, one beginning with “WIFI:” is network credentials, “BEGIN:VCARD” is a contact, and so on. This scanner performs exactly those steps locally in your browser and then classifies the decoded text for you.

QR code structure and error correction

One of the QR format’s most useful features is built-in error correction, which lets a code still scan even when it is partly dirty, damaged or covered by a logo. There are four levels — L (recovers ~7% of data), M (~15%), Q (~25%) and H (~30%). A code generated at level H can lose almost a third of its area and still decode correctly, which is why branded QR codes can place a logo in the middle without breaking. The trade-off is capacity: higher error correction leaves fewer modules for actual data, so the code becomes denser or physically larger.

QR codes come in 40 “versions”, from version 1 (a 21×21 grid) up to version 40 (177×177). The more data you encode, the higher the version and the more modules the code needs. A short link fits in a small, low-version code that scans easily from a distance; a long URL with tracking parameters, or a full vCard, produces a dense high-version code that needs a closer, steadier scan. When this tool decodes a QR with its JavaScript engine it reports the detected version, giving you a sense of how much data the code carries.

Understanding structure also helps you scan tricky codes. If a code won’t read, the usual culprits are a missing quiet zone, low contrast between the modules and background, glare or blur, or damage to one of the finder patterns. Re-photographing with even lighting, filling the frame and holding steady fixes most failures — and because this scanner can re-process an uploaded image at higher resolution and try inverted colours, it often reads codes that a phone’s built-in camera gives up on.

Static vs dynamic QR codes

A static QR code stores its data directly in the pattern. Whatever you encode — a URL, a WiFi password, a phone number — is baked permanently into the modules and can never be changed once the code is printed. Static codes are completely free, work forever without any service behind them, and are perfect for fixed information like a guest WiFi card, a digital business card or a one-off link. The only downsides are that you can’t edit them later, and longer data makes the pattern denser.

A dynamic QR code instead stores a short redirect link that points to content you control on a server. Because the destination is looked up at scan time, you can change where a dynamic code leads without reprinting it, and you can record analytics — how many times it was scanned, when, where and on what kind of device. That flexibility makes dynamic codes the standard for marketing campaigns, product packaging and anything you might need to update, but it requires a managed service and usually a subscription.

For a scanner, the practical difference is what you see in the decoded result. A static code reveals its real content immediately — the actual URL, the WiFi password, the contact details. A dynamic code reveals only the short redirect URL of the platform that hosts it (often a branded domain), and the final destination is resolved when you open it. That is exactly why checking a dynamic link’s domain, and being cautious with shorteners, matters: the visible URL is not always the final one.

QR phishing (“quishing”) and how to stay safe

Quishing is phishing carried out through QR codes. Because a QR code is unreadable to the human eye, attackers exploit the gap between what you think you’re scanning and where the code actually leads. Common attacks include sticking a fake QR over a legitimate one on a parking meter or restaurant table, emailing a QR that bypasses link filters, and printing codes on flyers that lead to credential-harvesting pages or malware. Since the rise of mobile payments and contactless menus, quishing has grown into one of the fastest-rising social-engineering threats, and the FBI and national cyber agencies have issued public warnings about it.

The single best defence is to preview the destination before you act on it — which is exactly what this scanner is for. Decode the code on a device where the link will not auto-open, read the real URL, and look for the warning signs the security panel highlights: a domain that is a near-miss of a known brand (paypa1.com instead of paypal.com), a link shortener that hides the destination, a raw IP address instead of a domain name, punycode or mixed-script characters used to fake a familiar name, or a suspicious top-level domain. Never enter passwords, card details or one-time codes on a page you reached only by scanning a code from an untrusted source.

Healthy habits make quishing far less effective. Treat unsolicited QR codes — in emails, on stickers, in the post — with the same suspicion as unknown links. For payments, confirm the exact payee and amount in the decoded result rather than trusting the surrounding label, because the most common real-world scam is swapping a merchant’s payment sticker for the attacker’s. And remember that a QR code itself cannot run code on your phone; the danger is always in where it leads or what it asks you to do next, so verifying the destination first neutralises almost every attack.

WiFi, contact and payment QR codes explained

A WiFi QR code encodes network credentials in a compact format that begins with “WIFI:”. It contains the network name (SSID), the security type (typically WPA/WPA2/WPA3, sometimes WEP, or open with no password) and the password itself, plus a flag for hidden networks. Scanning it lets a phone join the network without anyone typing the password — convenient for guests, but worth understanding: the password is stored in plain text inside the code, so anyone who photographs the code can read it. This scanner shows you exactly what a WiFi QR contains, which is handy for reading a password onto a device that can’t scan, or for checking that a posted code uses encryption rather than leaving the network open.

Contact QR codes use the vCard or MeCard format to store a person’s details — name, organisation, job title, phone, email, website and address. They are the digital equivalent of a business card: scan one and your phone offers to save a new contact with every field already filled in. This tool parses each field separately and can rebuild a downloadable .vcf file, so you can capture a contact from a badge, poster or email signature even on a desktop, and review precisely what information the card shares before saving it.

Payment QR codes come in several standards. UPI codes (ubiquitous in India) start with “upi://pay” and carry the payee’s virtual payment address, an optional amount and a note. EMVCo QR is a global merchant standard used by many bank and wallet apps. PayPal uses ordinary redirect links, the European SEPA “GiroCode” embeds an IBAN and amount, and cryptocurrency codes follow URI schemes like bitcoin: with an address and amount. Decoding a payment QR before you pay lets you confirm the exact recipient and value, which is the simplest way to avoid the tampered-sticker scams that target contactless payments.

QR codes vs barcodes: which is which?

Traditional barcodes are one-dimensional: they store data as a series of parallel lines of varying width, read by sweeping a laser or camera across them horizontally. The familiar EAN-13 and UPC-A codes on retail packaging are 1D barcodes, and they hold only a small number — usually a product identifier that a checkout system looks up in a database. They are cheap, fast and reliable for that single job, but their capacity is tiny (around 20 characters) and they must be reasonably aligned to scan.

QR codes and other 2D symbologies — Data Matrix, Aztec, PDF417 — store data in two dimensions, dramatically increasing capacity and resilience. A QR code can hold thousands of characters, be read from any angle, and survive significant damage thanks to error correction. That is why boarding passes use Aztec or PDF417, why industrial parts are marked with tiny Data Matrix codes, and why consumer-facing links, payments and WiFi use QR. This scanner reads both worlds: it decodes 2D codes including QR, Aztec, Data Matrix and PDF417, and 1D retail and logistics barcodes such as EAN, UPC, Code 128, Code 39, ITF and Codabar, telling you the exact symbology it found.

In everyday terms, reach for a 1D barcode when you only need to identify an item from a database at speed and cost matters, and a QR or other 2D code when you need to carry real data — a link, a payment, credentials, a ticket — or read it from a phone at any angle. Because this tool detects the format automatically, you don’t have to know in advance which kind you’re holding; just scan it and the result tells you both the symbology and the decoded content.

Private by design: scanning that never leaves your device

This QR scanner is built to be privacy-first. All decoding happens locally in your browser using the Web platform’s native BarcodeDetector API and a bundled JavaScript engine. Camera frames, uploaded images, pasted screenshots and PDF pages are processed entirely on your device — they are never uploaded, transmitted, logged or stored on any server. You can confirm this by scanning with your network disconnected: once the page has loaded, it keeps working offline.

Your scan history is equally private. It is kept only in your browser’s local storage, never synced to a server, and you can star favourites, delete individual entries, clear everything, or disable history entirely at any time. A “private mode” lets you scan without recording anything, and uploaded files are released from memory as soon as they are decoded. Because the sensitive data inside QR codes — WiFi passwords, 2FA secrets, payment details, personal contacts — is exactly the kind of information you don’t want leaving your device, doing all the work client-side is a deliberate security choice, not just a performance one.

For developers who do need server-side scanning — batch jobs, back-office automation — the tool also exposes a documented decode API. The browser tool and the API are separate: use the in-browser scanner for anything private, and the API only where the data already lives on your own infrastructure. Either way, there are no accounts to create and no limits on how many codes you scan.