QR code reader
A QR code is a URL you cannot read. Every scanning app on your phone decodes it and opens it in one motion, which is the whole problem — you find out where it goes by going there. Drop the image here instead: you get the text, and if it is a URL, its real host and a structural safety check first.
Drop a QR image here, paste one from the clipboard, or choose a file.
What is in it
How to use
- Get the code into the page: drag the image file in, click to choose one, or take a screenshot and press Ctrl/Cmd+V anywhere on the page.
- The decoded text appears in full. Read it before doing anything with it.
- If it is a URL, What is in it breaks out the scheme, host, path and parameter count, then lists anything structurally suspicious.
- Non-URL payloads are identified too — Wi-Fi credentials, vCards, calendar events,
mailto:,tel:andgeo:links.
Why reading a QR code before scanning it is worth the trouble
A printed QR code has no visible destination, cannot be hovered, and is trivially replaceable — a sticker over the one on a parking meter, a restaurant table or a poster costs nothing and looks identical. That combination is why QR-based phishing became common: the usual defence, looking at the link, is unavailable by design.
The checks here are the ones that can be made from the URL's structure alone. A shortener means the destination is hidden twice over, and no local tool can resolve it. Userinfo before the host (https://[email protected]) puts a trusted name where the host appears to be. A bare IP address instead of a domain is almost never legitimate for a public service. A Punycode host may be a homograph of a brand. Many subdomain labels push the real domain past where a phone's address bar truncates. http:// means the connection is not encrypted. For a deeper look at any of these, the obfuscated URL decoder goes through every technique.
A Wi-Fi QR code is a password in plain text. If the payload starts WIFI:, the network key is right there in the decoded string — worth remembering before printing one for a guest network on something visible from the street, and worth checking if someone hands you one.
FAQ
Is the image uploaded?
No. The file is read with FileReader, drawn to a canvas, and decoded in your tab. The decoder library is fetched from a CDN the first time, and after that nothing leaves the page — including the decoded URL.
Nothing decoded — what now?
Usual causes, in order: too low resolution (a code needs roughly 200 pixels across to decode reliably), a photograph taken at an angle, glare or shadow across the code, or the quiet-zone margin cropped off. Crop tighter around the code, straighten it, and try again. A screenshot of a code on screen decodes far more reliably than a photograph of one on paper.
Can it use my camera?
Not in this tool — camera access is a permission prompt for a job your phone's built-in scanner already does. Where this is useful is the opposite case: a code you have as an image, in an email or a document, that you want to read without pointing a phone at your own screen.
Does a clean report mean the link is safe?
No. It means the URL's structure contains none of the known disguises. A plain, well-formed https:// link to a domain registered yesterday looks perfectly clean and can still be a phishing site. For a reputation verdict, put the host into VirusTotal or urlscan.io.
How do I make QR codes?
The QR code generator for one, and the batch generator for a list — with a ZIP download and your own filenames.