Scan QR codes from an image or your camera, in this tab. Reads every code in a picture, rescues a faded or transparent one and says which step worked, and parses WiFi, vCard, calendar, geo and payment payloads by their published grammars.
Related reading
Initializing in your browser…
Read a linear or 2D barcode from an image or camera. Verifies the GS1 check digit, corrects a UPC-A that a browser reports as a thirteen-digit EAN-13, and names which decoder answered.
See an image through the two published models of colour vision deficiency, Machado 2009 and Vienot 1999, computed in linear light where those models are defined, with the colour pairs that stop being distinguishable listed by name.
Whole-pixel crops with the rectangle typed or dragged, checked by decoding the output and comparing it with the pixels that went in. Quarter turns and mirrors are exact permutations, so nothing is clipped.
A photograph of a cafe window holds a Wi-Fi code whose password contains a semicolon.
Payload in the code
WIFI:T:WPA;S:Cafe\;Bar;P:pa\;ss\:word;H:false;;
What the page shows
Network name (SSID): Cafe;Bar Security: WPA (WPA or WPA2 personal) Password: pa;ss:word (masked until you show it) Version 4, 33 by 33 modules, byte mode, 47 bytes
The Wi-Fi format separates fields with semicolons and escapes a literal one with a backslash, so the password is split on unescaped semicolons only. A pattern that stops at the first semicolon returns "pa\", three characters of nine. The panel also reports what the symbol is, not just what it said, and masks the password until you ask for it.
Scan and decode QR codes from an image or your camera, in this tab. The payload is read against its own published grammar, so a Wi-Fi password with a semicolon in it comes back whole, and the page says what the symbol is: its version, its encoding mode and its size in modules. A picture that will not decode is cleaned up and tried again, with every step listed.
Decode a QR code from a screenshot or photo to read the link before opening it on a phone.
Read the network name, security type and password out of a Wi-Fi code, with the password kept masked until you show it.
Photograph a page of tickets or labels and get every payload on it in one pass.
Decoding is done by the jsqr library, loaded only when you actually scan, and nothing leaves the tab. The picture is drawn to an off-screen canvas and the pixels are handed to the decoder with inversionAttempts set to attemptBoth, so a light-on-dark code reads as well as a dark-on-light one. Measured against a corpus generated by this site's own QR generator, where the payload of every fixture was chosen in advance and the module matrix was decoded back before it was ever drawn, that single pass reads 18 of 20 fixtures including a code at two pixels a module, a code turned 45 degrees, a code photographed at an angle, one with no quiet zone at all, an inverted one, a blurred one and a noisy one.
The two it could not read are the reason for everything else on the page. One was a code printed at low contrast (its darkest and lightest parts 2.2 to 1 apart, where ISO/IEC 18004 asks for at least 3 to 1) and it is fully recoverable: every module is still there and only the range is wrong. The other had 36 percent of its area covered by a logo, and the H error correction level carries about 30 percent of the codewords (ISO/IEC 18004 table 12), so its data is gone rather than merely hard to see. A picture that does not decode straight away is therefore put through a ladder of named steps (composite onto white, stretch the contrast, convert to grey under Rec. 709, sharpen, halve the size, double the size), each with the reason a real photograph needs it and each timed, and the page lists every step and says which one made the difference. When nothing works it says which measurable precondition the picture fails and states plainly that a covered code can be past recovery rather than blurry. The low-contrast fixture now reads, and the 36 percent one still does not, which is correct.
jsqr finds one symbol. Measured on a fixture holding two codes side by side, it returned nothing at all, because six finder patterns are present and the triple it picks spans both. After the whole picture is tried, a sliding square window the size of the shorter side sweeps across it and every distinct payload found is listed as its own result, so a sheet of tickets or a photograph of a noticeboard returns all of them. The panel also reports what the symbol IS rather than only what it said: the version, the module count derived from it by ISO/IEC 18004 table 1, the encoding modes used, the byte count, any ECI assignment, and, when the payload bytes are not valid UTF-8, the ISO 8859-1 reading that section 7.4.4 makes the default for byte mode.
Once a string comes back, everything after that is grammar, and each one is read against its own published document rather than searched for with a pattern: Wi-Fi credentials by ZXing's Barcode Contents rules, where fields are separated by unescaped semicolons and a backslash escapes any of \ ; , : and ", so a password containing a semicolon comes back whole; vCard by RFC 6350 including line folding and value escaping; MECARD; calendar events by RFC 5545; geographic points by RFC 5870 with each coordinate range checked and percent-encoded before it goes into a map link; mailto by RFC 6068; tel by RFC 3966; text messages in both the SMSTO and RFC 5724 forms; authenticator secrets; and SEPA payment requests by EPC069-12. Passwords and shared secrets are masked until you ask for them. A payload carrying a scheme is judged by the same rule the markdown tools use: a javascript: or data: URI is shown as text with the reason and gets no button, while an http or https address gets one. Scans accumulate in a list that lives in the page, exportable as RFC 4180 CSV, and is deliberately never written to storage, because a scan can hold a password or a payment instruction.
Any standard QR symbol. The payload is then classified against the published grammars for Wi-Fi, vCard, MECARD, iCalendar, geo, mailto, tel, SMS, otpauth and SEPA payment codes, and anything else is shown as text or judged as a URI.
The page tells you. It measures the contrast between the darkest and lightest parts of the picture and the size in pixels, lists every recovery step it tried, and separates a code that is hard to read from one that is past recovery: error correction at the H level covers about 30 percent of the codewords, so a logo or a tear over more than that destroys the data rather than obscuring it.
Yes. The Wi-Fi format separates fields with semicolons and escapes a literal one with a backslash, so a password is split on unescaped semicolons only and the escapes are removed afterwards. A pattern that stops at the first semicolon returns the first few characters instead.
Yes. The whole picture is tried first, then a sliding square window sweeps across it, and every distinct payload is listed separately.
Nothing here can tell you that. A QR code is data written by whoever printed it and it is checked against nothing. The tool will not offer an open button for a javascript: or data: payload, and it shows the scheme of anything else, but a working https link can still lead anywhere.
Yes, on a device with a camera and a browser that grants access. The camera and the file path use the same decoder settings, so a light-on-dark code that reads from a file also reads from the camera.
Images are decoded, edited, and exported entirely inside this browser tab. No originals, exports, or metadata are uploaded.