tooloora

QR Code Scanner — from image or camera

Read a QR code from a screenshot, photo or your camera. Decoding happens in your browser — the picture never leaves your device.

Runs locally — nothing is uploaded

Drop a QR code image here or choose a file

JPG, PNG, WebP, GIF or BMP — screenshots work too. The image stays on your device.

Neither the image nor the camera feed leaves your device: decoding happens entirely in the browser, nothing is recorded and nothing is uploaded.

How do I read a QR code on a computer?

Pick an image containing a QR code or start the camera: the code is decoded right in your browser and the content is shown in plain text, including its type — link, Wi-Fi, contact, event. Links are never opened automatically. Neither the image nor the camera stream leaves your device, and nothing is recorded.

Image or camera — when do I use which?

Reading an image is the fastest route whenever the code already exists digitally: a screenshot of an invoice, a photo of a poster, an exported ticket. Drop it in and you are done. If the first attempt finds nothing, the tool keeps trying automatically — scaled down, scaled down further, and with inverted colours, because light codes on a dark background often fail otherwise.

The camera is what you need for codes on paper or on someone else's screen. It only starts after you click "Start camera", prefers the rear-facing lens, and stops by itself as soon as a code is found, when you switch tabs or when you leave the page. No recording, no still image, no storage.

Why does this tool not open links automatically?

Because the QR code itself has no intent — its content does. In so-called quishing, fraudsters stick their own codes over legitimate ones, on parking meters or invoices, leading to a convincing fake payment page. The US Federal Trade Commission published a dedicated consumer alert about this in December 2023 and explicitly advises checking the address for typos and unfamiliar domains before opening it.

That is exactly what we enable: the full address sits there in plain text before anything happens. On top of that we flag two classic disguises:

PatternWhy it is dangerous
https://bank.com@evil.example/loginEverything before the @ is decoration — the real domain is evil.example.
Punycode (xn--…)The domain name contains special characters that look deceptively like Latin letters.

Non-web content such as javascript: or data: is always shown as text only and never turned into a link.

Which contents does the scanner recognise?

Besides plain text and links, all the structured formats scanner apps understand: Wi-Fi credentials (WIFI:), contacts as vCard, mailto:, SMS, tel:, coordinates (geo:) and calendar entries in iCalendar format. The fields are broken out individually — for a Wi-Fi code that means network name, encryption and password each on their own line. The raw text always stays visible and copyable.

Why is my code not recognised?

QR codes are standardised in ISO/IEC 18004 and carry Reed-Solomon error correction in four levels: L, M, Q and H restore roughly 7, 15, 25 and 30 percent of the data respectively when the code is damaged. That is a lot — but it has limits. Typical reasons for a failed attempt:

  • Too little contrast, or a reflection in the photo.
  • The code is cropped at the edge; the quiet zone around it is missing.
  • Heavy perspective distortion from a steep angle.
  • The image is too small: below roughly 200 pixels per side it gets tight.

Usually a fresh, straight, frame-filling shot helps more than any software.

Honest limits

This tool reads QR codes, not other symbologies: EAN barcodes, Data Matrix, Aztec and PDF417 need different decoders and are not supported. Camera mode requires an encrypted connection (HTTPS) and your explicit permission — without both, the image route remains. And the scanner only checks the shape of an address, never the reputation of the destination: an unremarkable domain can still be a scam site.

If you want to create QR codes instead, use the QR code generator — also entirely in the browser.

Frequently asked questions

Is my image or camera feed uploaded anywhere?

No. The image is drawn into a canvas and decoded by JavaScript running in your browser; the camera stream is analysed frame by frame and immediately discarded. Nothing is recorded, nothing is stored, and there is no upload endpoint. You can verify it: turn off your internet connection after the page has loaded — scanning still works.

Why does the scanner not open scanned links automatically?

Because that is exactly how QR phishing works. Fraudsters stick their own codes over legitimate ones on parking meters, posters and restaurant tables. We show you the full address in plain text so you can read the real domain first, and clicking is always your decision.

When do I need the camera and when is an image enough?

An image is enough whenever the code is already on your screen or in your photo library — screenshots, PDFs exported as images, tickets. The camera is for codes on paper or on another screen. It only starts after you press the button, never automatically.

The camera does not start — what is wrong?

Three common causes: you declined the permission (allow it in the site settings of your browser and start again), the page is not served over HTTPS (browsers block camera access on insecure connections), or the device has no camera. In every case the image route still works.

Which QR contents are recognised?

Plain text and links plus the structured formats: Wi-Fi access (WIFI:), contacts (vCard), email (mailto:), SMS, phone numbers (tel:), coordinates (geo:) and calendar entries (iCalendar). The raw text is always shown as well, so nothing gets lost in interpretation.

Can it read barcodes or Data Matrix codes?

No, deliberately not. This tool decodes QR codes as defined in ISO/IEC 18004. EAN barcodes, Data Matrix, Aztec and PDF417 need different decoders and are not supported here.