What the result contains
What This Tool Provides
Decode a QR code from an uploaded image or a live camera frame. Decoded content is displayed as text first. Only explicit HTTP or HTTPS payloads receive a separate Open link action and visible destination hostname; the scanner never navigates automatically.
- Decoded payload shown as text
- Copy action initiated only by the user
- Optional HTTP/HTTPS link with destination hostname
- Image upload fallback when camera access is unavailable
How to Use This Tool
- Choose an inputUpload an image up to 20 MiB and 40 million pixels, or request camera access.
- Present the codeUse a sharp, well-lit, uncropped QR image or hold the code steady in frame.
- Inspect the resultRead or copy the payload; verify the hostname before choosing Open decoded link.
How It Works
Uploaded images are decoded into a hidden canvas and passed to jsQR. Camera mode requests getUserMedia only after the button is pressed, samples a frame twice per second, and stops the tracks once a code is found or the user stops scanning. The result is assigned with textContent, so decoded markup cannot execute.
Worked Examples
URL payload
- Input
QR encodes https://example.com/path- Output
Decoded URL plus “Destination host: example.com”
Opening is an explicit action in a new tab; no redirect happens during scanning.
Plain text payload
- Input
QR encodes Ticket A-184- Output
Ticket A-184
Non-URL content can be copied but does not receive an Open link action.
Reading What You Scanned
A scanned payload is often not a plain link. Percent-escaped URLs are easier to read once decoded, and codes that carry data rather than a destination are usually Base64 wrapping JSON worth formatting.
If a code exposed a Wi-Fi password you would rather not keep, generate a replacement and create a new code for it.
Camera Permissions and Fallbacks
Camera access requires browser support, a secure context, a usable camera, and user permission. A blocked or unavailable camera does not prevent image upload. No camera recording is created or saved.
Safer URL Handling
A QR code can hide a misleading or malicious destination. The scanner accepts only http and https for its open action, displays the parsed hostname, and leaves the decision to the user. Email, phone, Wi-Fi, data, and script-like payloads remain plain text.
Important Edge Cases
- Blur, glare, low contrast, cropping, and very dense codes can prevent recognition.
- The first readable QR payload in a frame is returned.
- Large uploaded images are rejected before canvas allocation when their file or decoded pixel limit is exceeded.
Limitations
- The decoder reads QR codes, not every barcode format.
- Specialized payloads are not parsed into Wi-Fi, contact, email, or phone actions.
- Camera availability and permission behavior vary by browser and device.
Input handling
Private Browser Processing
Uploaded pixels and sampled camera frames stay in the browser processing path. They are not uploaded, saved, or provided to analytics; normal page-view analytics still runs.
Google Analytics records page visits and whether a tool finished or failed, but these tool implementations do not send field values, generated passwords, QR payloads, uploaded QR images, or camera frames to analytics or a Tiny Tiny Tools processing endpoint.
Safety note: Decoded text never runs as HTML or JavaScript, and a URL is never opened automatically.
See the Privacy Policy for site-wide details.
Questions About This Tool
Are camera frames uploaded or recorded?
No. Frames are sampled into a local canvas for recognition. The stream is stopped and no recording is created.
What if camera permission is denied?
The page shows a specific message and image upload remains available.
Will a scanned link open automatically?
No. The payload is shown first. HTTP/HTTPS results have a separate link that the user may choose.
Why was no QR code found?
Try a sharper image with the entire code, quiet border, strong contrast, and less glare.