QR Code Scanner

A QR code scanner reads the black and white squares on a poster, menu, parcel or screenshot and tells you what is inside before you act on it. Our free scanner works with an uploaded image, a pasted screenshot or your device camera. It recognises web links, Wi-Fi details, contact cards, emails, phone numbers and plain text, and shows each one in a readable form. Links are never opened automatically: you see the full address, the real website owner and any warning signs of a lookalike domain first. Images and camera video are processed on your device and are never uploaded.

How to use the QR scanner

1. 1 Choose image or cameraPick Image or screenshot to scan a picture you already have, or Camera to point your phone or webcam at a printed code.
2. 2 Add the codeDrop an image, choose one from your device, or paste a screenshot with Ctrl+V. For the camera, press Start camera and allow access when your browser asks.
3. 3 Read the decoded contentThe scanner shows what kind of code it is, such as a web link, Wi-Fi network or contact card, with the details laid out clearly.
4. 4 Check any warningsFor links, look at the website owner line and any amber warnings about lookalike domains, link shorteners or insecure http pages.
5. 5 Copy, save or openCopy the link or text, save a contact as a .vcf file, or open a link in a new tab only once you are happy it is genuine.

Why scan a QR code here instead of with your camera app

Most phones can read QR codes straight from the camera app, and for a restaurant menu that is usually fine. The problem is that the built-in scanners are designed for speed. They show a short preview of the link and invite you to tap it, often with only part of the domain visible. That is exactly what scammers rely on.

This scanner slows the moment down. It shows the complete address, pulls out the part that decides who owns the website, and flags common tricks before you go anywhere. It also handles things a camera cannot, such as a QR code inside a screenshot, an email attachment or a PDF you have captured as an image. If someone sends you a picture of a QR code, you can check it on your computer without pointing your phone at your own screen.

It is also useful for businesses. Before you print 5,000 flyers, scan the proof to confirm the code opens the right page, that the UTM tags are intact and that the Wi-Fi password on a guest card has no typing mistakes.

Quishing: how QR code scams work

QR code phishing, often called quishing, uses a code to hide a malicious link. Because you cannot read a QR code by eye, it is easy to stick a fake one over a genuine one on a parking meter, an electric vehicle charger or a restaurant table. UK councils and police forces have warned about fake parking payment codes that lead to lookalike payment sites.

Quishing also turns up in email. A message claims to be from Microsoft, your bank, HMRC or a parcel company and asks you to scan a code to fix a problem. Putting the link inside an image helps it slip past email filters that check text links, and moves you from a protected work computer to a personal phone.

The giveaways are the same as with any phishing link. The domain is close to, but not the same as, the real brand. The page asks for a login, card details or a payment straight away. There is pressure to act now. When a code asks you to pay or sign in, the safest habit is to ignore it and go to the organisation's official app or website by typing the address yourself.

What the link warnings mean

When a code contains a web link, the scanner runs a set of quick checks. They are signals, not a verdict: a link can pass every check and still be unsafe, and a genuine link can occasionally trigger a warning.

• Website owner: only the last part of the domain, such as example.co.uk, decides who controls the site. paypal.com.account-check.co.uk belongs to account-check.co.uk, not PayPal.
• Lookalike brand: the address mentions a well-known name such as PayPal, Amazon, HMRC, Royal Mail or a UK bank, or a version with swapped characters such as a zero for an o, but the site belongs to someone else.
• International characters: letters from other alphabets can look identical to Latin ones. The scanner shows the punycode form starting xn-- so the difference is visible.
• Link shortener: services such as bit.ly hide the real destination until you open them. Many genuine businesses use them, but so do scammers.
• http instead of https: the connection is not encrypted, so anything you type could be read in transit.
• An @ sign before the domain or a bare IP address: both are old tricks for disguising where a link really goes.

Wi-Fi, contact and other QR code types

QR codes can hold more than links. A Wi-Fi code stores the network name, the security type and the password in a short format starting WIFI:. The scanner shows the network name and security type, and keeps the password hidden until you choose to show or copy it. It also flags open networks and the outdated WEP standard.

Contact codes use the vCard or MECARD format and hold a name, job title, phone numbers, email and address. You can read the details on screen and save a vCard as a .vcf file to import into your phone or address book. Calendar codes hold an event title, time and location.

Other common types are mailto: links that start an email, tel: links that dial a number, SMS codes that prepare a text, and geo: codes with map coordinates. Codes holding a two-factor authentication secret (otpauth:) or a cryptocurrency payment request are shown with an extra warning, because both are used in scams and neither can be undone once acted on. Anything else is shown as plain text.

Camera access and privacy

The camera option uses your browser's standard camera permission. The first time you press Start camera, the browser asks whether to allow this site to use it. If you refuse, nothing happens and you can still scan images. If you change your mind, click the camera or padlock icon in the address bar to reset the permission.

Video frames are read by JavaScript on your device several times a second, looking for a QR code pattern. Nothing is recorded, stored or sent to a server. The camera turns off as soon as a code is found, unless you tick Keep scanning, and it also stops when you switch to image mode or leave the page.

Uploaded images are handled the same way. The picture is decoded in your browser and never leaves your device, which makes the tool safe for screenshots of documents, boarding passes or internal systems.

Tips when a QR code will not scan

If the scanner cannot find a code, the image is usually the problem rather than the code. The whole code, including the three large corner squares, needs to be in the picture with a little white space around it. Very small codes in a large photo can be missed, so crop the image around the code or take a closer photo.

Blur, glare and low light all reduce the contrast the decoder needs. Hold the phone steady about 15 to 30 centimetres away, tilt it slightly to avoid reflections on glossy paper, and move somewhere brighter. Codes printed in light colours, on patterned backgrounds or with heavy logos in the middle are harder to read, as are inverted codes with light squares on a dark background.

If a code still fails, it may be damaged, printed too small or deliberately broken. When you have the choice, ask the business for the web address instead. A genuine organisation will always be able to give you one.

Examples you can copy

Web link     https://www.example.co.uk/menu?utm_source=qr
Wi-Fi        WIFI:T:WPA;S:Cafe Guest;P:flatwhite2026;;
Email        mailto:hello@example.co.uk?subject=Booking
Phone        tel:+441614960000
Contact      BEGIN:VCARD ... FN:Sarah Thompson ... END:VCARD

https://www.royalmail.com/track         owner: royalmail.com
https://royalmail.com.redelivery.top/   owner: redelivery.top   (lookalike)
https://paypa1-secure.co.uk/login       owner: paypa1-secure.co.uk (lookalike)
https://bit.ly/3xYz                     shortener, destination hidden

Common mistakes to avoid

Frequently asked questions