QR code scanner

One QR code scanner for the camera, images and screenshots

A QR code is often somewhere other than a printed card in front of you. It may be inside an email, saved in Photos, attached to a message or already displayed on the phone you are holding. That is why this scanner treats the camera, an image file, a pasted picture and a screenshot as equal inputs. The same paths also recognize Data Matrix labels, while the receipt names the format that was actually found.

To use the camera, press the camera button and grant permission when the browser asks. Permission is never requested merely because the page loaded. Keep the entire square and its blank border inside the guide. When a code is found, the video tracks stop and the decoded value replaces the preview. Stop camera does the same immediately. If the camera is busy in another app or permission is unavailable, choosing a still image gives the decoder the same pixels without live access.

How to scan a QR code already on your phone

A phone cannot point its rear camera at its own screen. Take a screenshot or save the picture, return here, and use Choose image to select it from Photos. On systems that place screenshots on the clipboard, paste the image directly with the ordinary paste command. The whole square should be visible. A crop through a finder block or through the quiet white border can make an otherwise sharp code unreadable.

The image route is also useful on a laptop or desktop. Drag a saved PNG, JPEG or WebP onto the counter, choose it with the file picker, or paste an image copied from another application. CreatorValet reduces unusually large camera frames to a practical scan surface before sending their pixels to the local worker. It does not upload the original or a resized copy.

The destination is revealed before anything opens

Successful recognition means that the decoder recovered a string. It does not mean that the string is trustworthy. A QR image can contain an ordinary web address, plain text, WiFi credentials, a contact card, an email link, a phone number, an SMS instruction or an unusual application protocol. The receipt names common types but always shows the original decoded text so that a friendly label cannot hide what the code actually said.

Ordinary HTTP and HTTPS addresses can receive a separate Open address action. The scanner withholds that action when a URL contains embedded sign-in details, when the protocol is unknown, or when the value uses schemes such as javascript: or data:. An HTTP address and an internationalized hostname written in punycode receive an extra warning. These checks reduce accidental actions; they are not a phishing or malware verdict. Look at the displayed hostname and use a destination you recognize.

Reader, decoder and scanner describe the same job

People call this pattern a QR scanner, reader, decoder, camera code or square code. The input wording changes, but the useful result does not: recover the embedded bytes and present them accurately. This page therefore does not send image searches, screenshot reading and QR-to-text work to separate thin tools. Uploading a photo, pasting a screenshot and holding a code in front of a camera are three ways to reach one decoder.

Not every square symbol is QR. Data Matrix uses a solid L-shaped finder border and alternating modules on its other two edges; it is common on product, medical and logistics labels. The scanner now identifies both QR and Data Matrix instead of guessing from the square shape. Data Matrix recognition loads a separate 1.0 MB self-hosted reader only when the smaller QR reader finds no QR. Ordinary ECC 200, GS1 payloads, rotation and Unicode marked with UTF-8 ECI are supported. The Data Matrix generator creates the ordinary ECC 200 form. Aztec and conventional linear barcodes remain different formats; the barcode generator creates Code 128, EAN-13 and UPC-A symbols, but this scanner does not claim to read those bars.

Read a WiFi QR code without hiding the password

A WiFi QR code is still text. Its payload normally carries the network name, security type, password and hidden-network flag in a compact syntax. The scanner identifies that family but leaves the exact string available instead of silently joining a network. That matters on a shared device: scanning should not turn into a connection attempt before you have seen which credentials were encoded.

To make the opposite artifact, use the WiFi QR code generator. Its form escapes the network name and password rather than asking you to assemble punctuation by hand. For ordinary text and web addresses, the QR code generator creates static PNG and SVG files and checks their finished pixels before download.

Why an image can contain a valid code that still will not scan

QR recovery needs more than recognizable black squares. The three large finder patterns must be present, modules need enough contrast, and the surrounding quiet zone must separate the symbol from nearby artwork. Motion blur, reflections, aggressive JPEG compression, a logo over the wrong modules and a screenshot scaled with smoothing can each remove the boundaries the decoder measures. Try the original image before a copy saved through a social app, and include a little space around the code rather than cropping exactly at its edge.

If this scanner reads the digital image but a printed sign fails, test the final physical proof. Printer dots, glossy material, viewing distance and lighting are outside the uploaded pixels. If the code fails here as well, the original generator should increase contrast, restore the quiet zone or remove the overlay rather than merely enlarging a blurred copy.

Camera frames and images stay in this browser tab

The image rasterizer, worker, QR reader and Data Matrix reader are self-hosted. Camera frames are drawn to a local canvas and transferred to the worker; chosen and pasted files follow the same path. No frame, decoded URL, password or contact card is sent to an API, analytics endpoint or third-party CDN. Reloading clears the receipt, and stopping the camera ends its media tracks.

You can confirm that boundary rather than taking it on trust. The guide to verifying local processing shows how to open the browser Network panel, perform a scan and inspect every request. The decoder code may load from CreatorValet after the first action, but the image itself should never appear in an outbound request.