QR Code Scanner from Image

See what a QR code in a photo contains, and where it leads, before you open it

The QR Code Image Scanner reads QR codes from a saved photo or screenshot and shows the text inside. There is no need to point another device at a QR code that is already on your screen, and when one photo holds several codes the tool finds all of them and numbers each one. For a web address, the reading card shows the site it actually connects to. For Wi-Fi it shows the network name and password, and for contact, two-step login and payment codes it splits the content into labeled fields.

The photo is never uploaded; it is read inside this browser only. Addresses are never opened automatically, so you can check the content and the destination first, then copy or open only what you need.

When is this useful?

QR codes were designed to be scanned with a camera, but in practice the code is often already inside a screen or a photo.

• A QR code on the same phone: an event code received in a messaging app, a ticket code attached to an email or a code shown inside an app cannot be scanned by that phone's own camera. Save a screenshot and choose it here.
• A QR code on a computer screen: for a code on a web page or in a document, capture the screen and paste it with Ctrl+V (⌘+V on Mac).
• Finding a Wi-Fi password: Android phones can share the connected Wi-Fi network as a QR code. Capture that screen and read it here to see the password you need to type on another device.
• Checking an address before opening it: see whether the code on a poster, a letter or a parking sign really leads to the organization it claims. The US Federal Trade Commission advises inspecting the URL before opening a code found in an unexpected place.
• Checking before printing: compare a QR image you made against the address or text you intended, or verify every code on a poster in one pass.

How to use the scanner

1. Press Choose photo, or drag a photo onto the work area. A copied image goes in with Ctrl+V (⌘+V) or the Paste button.
2. Reading starts as soon as the photo is chosen. A scan line sweeps over the photo, then each QR code found gets an outline and a number.
3. Press a number chip at the top of the reading card (or an outline on the photo) to pick the code to read.
4. Check the breakdown by type and the QR raw text. For a web address, look first at the highlighted “Goes to” line and any flagged points.
5. Use copy, TXT download, password copy or .vcf download as needed. An address opens in a new tab only when you press its open button.

The photo shown at first is a sample made from an imaginary cafe info card; choosing a real photo replaces it. Clear empties the photo and results, while the original on your device and anything you already copied stay as they are.

What is inside a QR code, and what this tool shows

A QR code is only a container for text. Kinds such as “Wi-Fi” or “contact” are decided by how that text begins. The tool recognizes the patterns below and splits them into fields; anything it does not recognize is shown as raw text.

The Wi-Fi and contact formats follow the conventions documented by the ZXing barcode library. In a Wi-Fi string the characters \ ; , " : are written with a leading backslash, so the tool removes the backslashes and shows the real name and password.

Look at “Goes to” before you open an address

In a web address, the part that decides which site you actually reach is the end of the host name. Whatever comes before it can be chosen freely by the site owner, so a familiar organization name at the front means nothing when the ending is different. The reading card highlights that ending as “Goes to” and adds an exclamation mark when something deserves a second look.

• Addresses containing @: in the address format, the part before @ is a user name, and the browser connects to what follows @. The tool gives such addresses no open button.
• Endings such as co.uk: endings where anyone can register a name (public suffixes) are counted together with one more label to form “Goes to”. Only a commonly used part of the Public Suffix List is built in, so a rare ending may show just the last two labels. Shared hosting where anyone can get a subdomain, such as github.io or azurewebsites.net, is treated the same way, so the name in front of it is shown too.
• Short links: with bit.ly, tinyurl.com and similar services the final destination appears only after opening. This tool never visits an address in advance, so it cannot show where a short link ends up.
• This is not a safety verdict: the absence of a flag does not mean an address is safe. Look-alike sites can also use https, so compare the ending with the address the organization itself publishes.

The US Federal Trade Commission warned in December 2023 that scammers hide harmful links in QR codes, including by covering real codes with their own, and advises inspecting the URL before opening it and checking for misspellings or a switched letter. The FBI Internet Crime Complaint Center (IC3) reported in January 2022 that cybercriminals tamper with both digital and physical QR codes to replace legitimate codes with malicious ones, and advised checking that a physical code has not been covered with a sticker.

Finding a password in a Wi-Fi QR code

The raw text of a Wi-Fi QR code looks like WIFI:T:WPA;S:Roberin Guest;P:latte-2026;;. T is the security type (WPA or WEP, or nopass when there is no password), S is the network name, P is the password, and H:true marks a hidden network whose name is not listed. The order of fields may vary. The right-hand QR code in the sample photo is this string, and the reading card shows the network name “Roberin Guest”, WPA/WPA2 security and the masked password.

On an Android phone, opening the Wi-Fi network in Settings and choosing the share option displays a QR code that lets another device join the same network (as described in Android Help; menu names vary by device). Capture that screen and read it here to find the password you must type on a laptop or any device that cannot scan the code. The password starts masked and appears only after you press Show.

A two-step login QR code is the secret key itself

The QR code shown when you first link an authenticator app holds an address shaped like otpauth://totp/Service:account?secret=…&issuer=Service. According to the Google Authenticator key URI format, secret is a required value holding the secret key in Base32. Anyone with that key can generate the same six-digit codes, so the tool masks the key and shows an exposure warning.

Even when you are only checking a backup, do not post the screenshot to a messaging app or a shared cloud folder. If you suspect the key has leaked, turn off two-step login at that service and register again with a new QR code.

With a payment QR code, check the merchant name

Many countries use the “Merchant-Presented Mode” format defined by EMVCo for in-store payment codes. Indonesia's QRIS and Japan's unified JPQR are built on it as well. The raw text is a sequence of a two-digit ID, a two-digit length and a value, and this tool decodes the following IDs.

• 59 merchant name · 60 city · 58 country: values to compare with the merchant your payment app displays.
• 54 amount · 53 currency: with no amount, you type the amount at payment.
• 01 QR type: 11 is static (posted at the shop) and 12 is dynamic (generated for each payment).
• 63 checksum (CRC): must equal the value calculated from the preceding content. A mismatch means the content was altered or the QR code was built incorrectly.

Payment codes that are not in EMV format (app-specific links or formats) appear in this tool as a web address or as text. In every case the tool makes no payment and cannot confirm that the shop or amount is genuine. The FBI also advises against paying through a site reached from a QR code, and instead entering a known, trusted address by hand.

When the text looks garbled

DENSO WAVE explains that a QR code can hold data in any character code as bytes, and the reader must process it with the same character code. A code made with an older generator in Shift_JIS or EUC-KR will therefore look garbled or empty if it is read only as UTF-8. The tool decides the encoding in this order.

1. If the QR code carries an encoding designation (ECI), that encoding is used.
2. Otherwise the bytes are tried as UTF-8 first, then Latin-1 (Windows-1252). Shift_JIS and EUC-KR are never guessed; you pick them yourself.
3. A code holding only letters and digits reads the same in every encoding, so no encoding is shown.

If the automatic choice is wrong and the text looks strange, press another encoding under “Garbled text? Change the encoding” below the reading card. Japanese Kanji mode is decoded with the Shift_JIS table.

QR size (version) and capacity

QR codes come in versions 1 to 40, and each step up adds four modules (small squares) to each side. The version and module count under “Size” on the reading card are the values in this table.

The largest, version 40, at the lowest error correction level (L) holds up to 7,089 digits, 4,296 uppercase letters and digits, 2,953 bytes, or 1,817 Kanji characters. In UTF-8, accented letters such as é take 2 bytes, and most other non-Latin characters take 3, so text with them fits fewer characters than plain English. The longer the content, the denser the modules, and the harder a small photo is to read.

What to check when no QR code is found

DENSO WAVE specifies a blank margin four modules wide on every side of a QR code. A module is one small square of the code, and without the margin the edge of the code is hard to tell apart from the surrounding pattern.

• Cropped too tight: do not crop a screenshot right against the edge; keep the blank space around the code.
• Blur and glare: the original image or a screen capture reads better than a photo with light smeared across it.
• A small QR code: if the code is tiny inside a large photo, crop to it with its margin and upload again. The tool searches first with the long side at 1,280 px; if nothing is found, a larger photo is searched again at up to 2,560 px (never above its original size), and a photo whose long side is 1,280 px or less is enlarged 2 to 4 times for one more search.
• Covered or decorated: a logo, sticker or heavy creasing over the code may exceed what error correction can restore.
• Inverted QR codes: codes printed as light modules on a dark background are also found, and are marked “Colors: Inverted”.

“Not found” only means no QR code could be read from the photo. It does not mean the code has expired or is empty.

The photo is read only inside your browser

As MDN's File API guide describes, a web page can read a file the user chose directly on the device, and this tool reads photos only that way. The chosen photo is drawn on screen, its pixels are handed to a Web Worker inside the browser to find QR codes, and neither the photo nor the results are stored anywhere or placed in the address bar. The decoding engine is the open-source library jsQR 1.4.0, bundled unchanged on this site.

This does not mean the page itself, its script files and ads are free of network traffic. If you checked something sensitive, such as a Wi-Fi password or a two-step login code, press Clear and close the window on a shared computer.

Common mistakes

• Expecting the text printed under the code: QR reading is not optical character recognition (OCR), so captions or numbers printed beside a code do not appear in the result.
• Trusting an address because an organization's name appears in it: a name at the front proves nothing when the ending is different.
• Assuming a coupon or ticket is valid because it was read: reading the raw text cannot tell whether a coupon is still usable or a ticket still valid; only the issuer's system knows.
• Pasting an image address: Paste accepts image data, so pasting the text of an image address reads nothing. Copy the image itself, or save it as a file and choose that.
• Only renaming the file extension: renaming a HEIC file to .jpg leaves its format unchanged, so it may not open. Export a JPG from your photo app or use a screenshot.

Limits and cautions

• One photo at a time, up to 20 MB and 32 megapixels. At most 12 QR codes are found per photo, and reading stops if one size takes more than 20 seconds.
• Only QR codes are read. Striped barcodes, Micro QR and other 2D codes such as Data Matrix are not, and structured-append codes split over several QR codes are not joined.
• There is no camera capture, no reading history and no loading of images from outside addresses. A PDF must be turned into a screenshot, and HEIC is read only by browsers that can open it.
• “Goes to” is worked out from part of the Public Suffix List; the tool does not check whether a site is safe or where a short link finally ends up.
• The type labels are hints based on the shape of the raw text; the tool cannot tell whether a Wi-Fi password is still current or whether a payment QR code belongs to the real shop.

As of The QR specifications, format conventions and official warnings were checked on 2026-10-20.

Sources

• 01DENSO WAVE: How to make QR codes easy to readA QR code needs a margin four modules wide on every side
• 02DENSO WAVE: QR code versionsVersion 1 (21×21) to 40 (177×177), four modules added per side with each version
• 03DENSO WAVE: QR code standardsMaximum 7,089 digits, 4,296 alphanumeric, 2,953 bytes, 1,817 Kanji
• 04DENSO WAVE: FAQAny character code can be stored as bytes, and the reader must process the same character code
• 05ZXing: Barcode ContentsWIFI, MECARD, SMSTO, geo, tel and mailto formats, Wi-Fi symbol escaping
• 06Google Authenticator: Key Uri Formatotpauth://TYPE/LABEL?PARAMETERS, secret is a required Base32 value
• 07FTC Consumer Alerts: Scammers hide harmful links in QR codes to steal your information (2023-12-06)Inspect the URL before opening a code found in an unexpected place; look for misspellings or a switched letter
• 08FBI IC3: Cybercriminals Tampering with QR Codes to Steal Victim Funds (2022-01-18)Criminals tamper with digital and physical QR codes to replace legitimate codes with malicious ones
• 09Android Help: Connect to Wi-Fi networks on your Android deviceSharing Wi-Fi from Settings gives a QR code another device can scan to join
• 10EMVCo: QR code payment specificationsMerchant-Presented Mode v1.1: 59 merchant name, 54 amount, 01 static 11 or dynamic 12, 63 CRC (polynomial 1021, initial value FFFF)
• 11Bank Indonesia: QRIS news release (2019-08-17)QRIS uses the international EMVCo standard
• 12Payments Japan Association: JPQR MPM Guideline 3.0The data layout of the unified static QR code follows the EMV specification (MPM)
• 13Public Suffix ListList of endings (public suffixes) under which anyone can register a name
• 14MDN: Using files from web applicationsHow a web page reads a local file the user has chosen
• 15WHATWG: Encoding StandardLabels for EUC-KR, Shift_JIS and windows-1252 (Latin-1) that browsers read
• 16jsQRDecoding engine, Apache-2.0, version 1.4.0 used

Frequently asked questions

Tools to use with this one