This QR code scanner reads a QR code from your camera, an image file or a pasted screenshot and decodes it in your browser, so nothing is uploaded. Before you open anything, it shows the real domain of a link in large type and flags shortened, lookalike or unencrypted links. Links never open on their own. It is one of the free ghacks tools.
How to scan a QR code online
Pick a mode, add the code, and read the result before acting on it.
- Choose Camera for a printed code or Image or screenshot for a saved picture. Phones start in Camera mode, computers in image mode.
- Click Start camera and allow access, or click Choose image, drop a file on the box, or paste a screenshot with Ctrl+V.
- Check the Domain field on the result card, then use Copy content or Open link. Scan another code starts over.
The camera stops once a code is found. Several codes in one image get one card each.
How to scan a QR code from a screenshot or picture
Take a screenshot of the code, open this page and add it in Image or screenshot mode. That is also how you scan a QR code that is on your own phone.
On your phone
Screenshot the code, open this page, tap Image or screenshot, then Choose image, and pick the screenshot from your photos. If an iPhone photo will not open, it is probably HEIC: screenshot the photo and use that.
On a PC or laptop
For a code in an email, PDF or web page, press Win+Shift+S (Cmd+Ctrl+Shift+4 on a Mac), select the code, click on this page and press Ctrl+V (Cmd+V). No file needed. If your webcam is not detected, run the webcam test.
How to scan a QR code on iPhone and Android without an app
Your phone's camera already reads QR codes: point it at the code and tap the link that appears.
iPhone
Use the Camera app (iOS 11 and later) or the Code Scanner in Control Center. Neither shows warnings, so photograph a code you do not trust and check it here.
Android
Aim the camera app at the code. If no link appears, use Google Lens; on Samsung phones, turn on Scan QR codes in the camera settings. For a dedicated app, ghacks reviewed BinaryEye, an open-source, ad-free scanner.
What the result means: the link safety check
The large Domain field shows the registrable domain, the part that tells you who runs the site. In our test, http://paypal.com.secure-login.xyz/verify?acct=1 showed secure-login.xyz as the domain, with warnings for no encryption and a brand name on a different domain.
| Warning | What it means | What to do |
|---|---|---|
| No encryption (http) | Unencrypted connection | Enter no personal data |
| IP address instead of a domain | No name to check | Open only your own devices, such as a router |
| International characters (punycode) | Letters that only look Latin; Unicode and ASCII forms shown | Compare letter by letter |
| Link shortener or redirect service | Hidden destination, common with dynamic QR services | Open only if you trust the source |
| "@" trick in the link | The browser ignores text before the @ | Trust only the Domain field |
| Brand name on a different domain, Lookalike domain | Imitation, such as 0 for o or rn for m | Type the brand's address yourself |
| File download | APK, EXE or similar file | Never install from a QR code |
| Free hosting or dynamic DNS | Anyone can create a site there | Treat the owner as unknown |
A link with warnings needs a second click on Open anyway; javascript:, data:, file: and intent: links never open. A clean result is not a guarantee: the rules check the address, not the site, and there is no online blocklist lookup.
How to spot a malicious QR code (quishing)
Quishing is phishing through a QR code that leads to a fake login or payment page or a malicious download. Treat codes on parking meters, unexpected letters, parcel notices and emails as untrusted.
- Check for a sticker placed over the original code.
- Distrust urgency: "pay now", "account locked", "missed delivery".
- Never enter passwords or card details on a page reached through a code.
- Install apps only from your app store.
The US Federal Trade Commission warned about harmful links in QR codes in December 2023, and in 2015 ghacks already covered an app to check where a QR code leads before you open it. If you typed a password on such a page, change it with the password generator.
What a QR code can contain
Usually a web address, but a QR code, the two-dimensional barcode Denso Wave introduced in 1994, can also carry Wi-Fi logins, contacts, payment data and 2FA keys. The scanner shows each type as fields.
| Type | Starts with | Shown as |
|---|---|---|
| Website link | https:// |
Domain, host, path, warnings |
| Wi-Fi network | WIFI: |
Network name, security, password hidden until Show |
| Contact | BEGIN:VCARD, MECARD: |
Name, phone, email, address |
| Bank transfer (EPC QR code) | BCD |
Recipient, IBAN with checksum test, amount, payment warning |
| 2FA setup code | otpauth:// |
Issuer, account, hidden secret, warning |
| Email, phone, SMS | mailto:, tel:, SMSTO: |
Fields; premium-rate warning |
| Location, calendar event | geo:, BEGIN:VEVENT |
Coordinates; event details |
Privacy: what happens to your camera and images
Nothing leaves your device: the camera starts only after Start camera and stops after a scan, on Stop camera or when you switch tabs. Where the browser has a built-in QR decoder, the scanner uses it; otherwise it loads the open-source jsQR decoder from ghacks once. To verify, press F12, open the Network tab and scan an image: no request carries your image.
FAQ
Is it safe to scan QR codes?
Scanning itself is safe: a QR code is only text and cannot run anything just by being read. The risk is in what you open afterwards. Check the domain before you tap a link, never enter logins or payment details on a page reached through a code, and do not install apps from one.
Why will my QR code not scan?
Usually the image is too small, blurry or dark, or cropped too tightly. Crop it so the code fills most of the picture, add light and contrast, and keep the white border. With the camera, hold steady about 15 to 30 cm away, or photograph the code and use Image or screenshot mode.
Can I scan a QR code on my laptop?
Yes. Use the webcam in Camera mode, or screenshot the code with Win+Shift+S (Cmd+Ctrl+Shift+4 on a Mac) and paste it with Ctrl+V. Pasting is faster for codes in emails, PDFs and web pages and works without a camera. Nothing needs to be installed.
Does this scanner store my images?
No. Images and camera frames are processed in your browser and are never uploaded, saved or sent to ghacks; closing the tab clears them. Links are checked with local rules, so the address inside the code is not sent to a lookup service either.