QR code reader — see the link before you open it
Decode a QR code from a photo, a screenshot or your camera, and see exactly what it contains — including the full destination of a link — before deciding whether to act on it.
Runs in your browser — your input is not uploaded to ToolsNow.
Camera is off.
Your files are processed locally in your browser and are not uploaded to ToolsNow.
Nothing is opened or acted on automatically. A QR code is just a way of writing text, and the pattern itself gives no clue where it leads — which is exactly what makes a sticker placed over a genuine code on a parking meter or a restaurant table effective. The full destination is shown here first, and a link only becomes clickable when it uses http or https. Schemes that can execute or load data directly are never made clickable at all.
The warnings flag characteristics worth a second look — punycode domains that can imitate a familiar name, raw IP addresses, embedded credentials, unusual ports, very long addresses. They are observations, not a verdict: no reader can tell you whether a destination is safe, and nothing here checks the address against any reputation service, because doing so would mean sending your scanned link to a third party. Wi-Fi codes show the network and password without joining anything; contact cards are previewed without being saved.
Decoding runs entirely in this page. Images and camera frames are read into a canvas on your device and are not uploaded. The camera stops the moment a code is found or you press stop, and the stream is released when you leave the page.
How to use
- Provide the code. Drop in a photo or screenshot, paste an image, or use your camera.
- Read what it contains. The raw content is shown verbatim, with structured fields for links, Wi-Fi, contacts and the rest.
- Check the warnings. Punycode domains, raw IP addresses, embedded credentials and unusual schemes are all flagged.
- Decide. Links become clickable only when they are ordinary http or https, and only when you click.
Questions
Why does the QR pattern not show where it goes?
Because the pattern is just an encoding of text, and no part of it is human-readable. Two codes leading to completely different places look equally trustworthy, which is the whole basis of "quishing" — printing a sticker with a malicious code and placing it over a genuine one on a parking meter, a restaurant table or a parcel locker. Reading the destination before following it is the only defence, and it is what this tool exists for.
Can you tell me whether a link is safe?
No, and any tool claiming otherwise is overselling. What you get here is a clear view of the actual destination plus flags for characteristics that deserve a second look — punycode domains that can imitate a familiar name, bare IP addresses, credentials embedded in the URL, non-standard ports, unusually long addresses. Those are observations, not a verdict. The address is also not submitted to any reputation service, because that would mean sending your scanned link to a third party.
What is punycode and why is it flagged?
It is how non-ASCII characters are encoded in domain names, appearing as an xn-- prefix. It has entirely legitimate uses, but it also allows a domain built from Cyrillic or Greek letters that look identical to Latin ones to imitate a familiar brand. Seeing the flag does not mean a domain is malicious — it means the name you read may not be the name that resolves.
What happens with a Wi-Fi code?
The network name, security type and password are displayed and nothing is joined. Open networks are called out, because traffic on them is not encrypted by the network itself.
Are images or camera frames uploaded?
No. The image is drawn to a canvas in this page and the pixels are decoded on your device. Camera frames are read the same way and never leave the browser. The camera stops as soon as a code is found or you press stop, and the stream is released when you leave the page.
Nothing was found in my image — why?
Usually focus, angle or size. The code needs to be reasonably sharp, roughly square-on, and large enough in frame that its squares are distinguishable. Cropping tightly to the code and rescanning solves most failures. Heavily damaged or partially obscured codes may still be readable, since QR encoding includes error correction, but there are limits.