How to scan a QR code
- With the camera: press Scan with camera and allow access. Hold the code steady so it fills about a third of the picture. On a phone the rear camera opens; switch cameras, turn on the torch or zoom in with the controls under the picture.
- From an image: drop a photo or screenshot on the box, or click it to choose one. It looks for several codes at once, including small, rotated and inverted (light on dark) ones, and numbers each one it finds. Big photos are also read at full resolution, so small codes in a wide shot aren't missed.
- From the clipboard: copy an image or take a screenshot, then press Ctrl+V (⌘+V on a Mac) anywhere on this page. Pasting text decodes the text instead.
Every scan is added to the list under the results, where you can copy it again or export the whole session as a CSV file for a spreadsheet.
What the scanner decodes
Most scanners show you the raw text. This one reads the formats inside codes and explains them:
- Links: the real website name, with checks for lookalike and fake addresses (below).
- Wi-Fi: network name, security type and password, ready to copy.
- Contacts and events: vCard and MeCard contacts to save as a .vcf file, calendar events to save as an .ics file, email, phone, text message and map locations.
- Payments: EMV merchant codes (PIX, PayNow, PromptPay, QRIS, DuitNow, VietQR, QR Ph and card-network codes) and UPI links, showing the payee, amount, currency and scheme, with the code's checksum verified.
- Invoices and bills: Saudi ZATCA e-invoice codes, European SEPA transfer codes (EPC QR, also called GiroCode) and Swiss QR-bills, with the IBAN and reference check digits verified.
- Barcodes: EAN and UPC product numbers, ISBNs, GS1 codes on medicine packs (product number, expiry, batch, serial), Data Matrix, Aztec, PDF417, Code 128 and more.
- Two-factor setup codes: which account they set up, with a warning, because they hold a secret key.
How to spot a fake QR code
Scammers stick their own codes over real ones on parking meters, restaurant tables and posters, and send them in emails and letters, because a code hides the address until it opens. This is called quishing. Before you open a link, the scanner shows the website it really goes to and flags:
- lookalike names (paypa1, letters from another alphabet, a brand name on someone else's site);
- link shorteners and dynamic QR services, which hide or can change the destination;
- addresses with an @, a bare IP address, no https, a download of an app file, or a second website tucked inside the link;
- free hosting sites and domain endings that are among the most abused for phishing.
No warning doesn't prove a site is safe. The page never opens or looks up the link to check it: that would tell the scammer the code was scanned. If a code on a sign asks you to pay or log in, type the organisation's address yourself or use its official app instead.
Paying with a QR code: check the payee
A payment code can carry any name, so the scanner shows who the money really goes to: the payee's name, city and country, the account, PIX key or UPI ID, the amount and currency, and whether the code is static (a printed sign) or made for one payment. A checksum that doesn't match means the code was damaged or edited, and payment apps refuse it. A matching checksum only means the data is intact. Always compare the payee your banking app shows with the one you expect before you confirm.
When no code is found
- Move closer, so the code fills more of the picture, and keep a white border around it.
- Add light and avoid glare; turn on the torch for dark places, or tilt the code away from reflections.
- Try both sides of a code on glass, and flip a photo that was taken in a mirror.
- For a code in a PDF, take a screenshot of it and paste it here.
- If the camera doesn't start at all, check it with the webcam test.
Private by design
Everything happens in your browser: the reader is zxing-cpp, compiled to WebAssembly and loaded from this site. Images and camera frames are never uploaded, and scanned content is never sent anywhere. The page only reports which kind of code was found, never what it said. To check what else an image carries, use the EXIF viewer for hidden photo data or the Content Credentials checker for an image's signed history.
Sources
Each format is decoded to its published specification, checked on 25 September 2026: EMV QR Merchant-Presented Mode v1.1 (EMVCo, 2020), the Pix manual v2.10 (Banco Central do Brasil, 2026), the Thai QR standard (Bank of Thailand, 2019), DuitNow QR v1.5 (PayNet), UPI Linking Specifications v1.6 (NPCI), ZATCA's e-invoicing guidelines (2022) and security standard v1.2 (2023), EPC069-12 v3.1 (2024), the Swiss QR-bill guidelines v2.3 (SIX, 2023), the WPA3 specification (Wi-Fi Alliance) and the GS1 General Specifications (2026). PayNow and QRIS don't publish theirs, so those follow published sample codes. The link advice follows the FTC (2023) and FBI (2022); the risky domain endings come from Interisle's Phishing Landscape 2026 and Spamhaus (2026), and the UPI advice from the RBI (2022).