Secure QR Code Decoder & Inspector
Decode QR codes from images, screenshots, or webcam input and inspect the payload safely before opening any link.
Scan QR codes safely. Everything is decoded locally in your browser. No uploads. No server-side analysis. No automatic redirects. Safe for banking links, crypto wallet codes, Wi-Fi payloads, and private screenshots.
Drop a QR code image here, click to browse, or paste a screenshot
PNG, JPEG, WebP, GIF supported · ⌘V / Ctrl+V to paste a screenshot
All QR code decoding runs locally in your browser using the jsQR library. No image is uploaded to CodeAva servers, no frame is transmitted, and nothing is stored between sessions. This makes the tool safe for banking QR codes, crypto wallet addresses, internal Wi-Fi credentials, private contact cards, and any sensitive screenshot you cannot share with an external service.
Why QR codes need a safe inspection step
QR codes are deliberately opaque. They encode a destination, a password, a contact card, or a payment address in a visual pattern that gives no indication of its contents until scanned. That invisibility is also what makes them a practical tool for attackers: a QR code printed on a poster, embedded in an email, or stuck over a legitimate code at a payment terminal can redirect a victim to a phishing page without the user ever reading a suspicious URL. This attack pattern is widely known as quishing — QR phishing.
On a laptop or desktop, reading a QR code has traditionally required a separate smartphone. This friction creates a gap: if you want to verify what a QR code contains before scanning it on your phone, there has been no easy way to do that from your computer. This tool fills that gap. Paste a screenshot, upload an image, or point a webcam at the code, and the payload is decoded locally in your browser — with no automatic redirect and no external upload.
Beyond security inspection, QR codes appear in everyday workflows: restaurant menus, Wi-Fi login posters, event tickets, app install pages, product packaging, and marketing campaigns. Being able to inspect the payload — extract a Wi-Fi password, save a contact card, or review a checkout URL — without needing a phone scanner is practically useful for developers, support teams, designers, and security-conscious everyday users alike.
How can I read a QR code from an image on my computer?
You do not need a smartphone to read a QR code. Upload a saved image, paste a screenshot directly from your clipboard, or use your webcam in this browser-based QR decoder. CodeAva decodes the QR code locally using the jsQR library and shows the hidden URL, Wi-Fi details, contact card, or plain text without automatically opening it. The quickest workflow on a desktop or laptop is to take a screenshot of the QR code and paste it with Ctrl+V or ⌘V.
QR payload cheat sheet
QR codes can encode many different data types beyond simple URLs. Here is a reference of the most common formats and what they look like in raw form:
| Data type | Typical payload syntax |
|---|---|
| Website / URL | https://example.com/path?ref=qr |
| Wi-Fi network | WIFI:T:WPA;S:MyNetwork;P:MyPassword;; |
| Contact (vCard) | BEGIN:VCARD
FN:Jane Smith
TEL:+15551234
END:VCARD |
| Contact (MeCard) | MECARD:N:Smith,Jane;TEL:+15551234;EMAIL:[email protected];; |
mailto:[email protected]?subject=Help | |
| SMS | smsto:+15551234:Message text |
| Geo coordinates | geo:48.8584,2.2945 |
| Crypto wallet URI | bitcoin:1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf?amount=0.001 |
What is quishing and why does it matter?
Quishing is QR code phishing. Because QR codes visually conceal their destination, attackers use them to bypass the habit of hovering over links to check URLs before clicking. A QR code in a printed flyer, on a restaurant table, in an email, or overlaid on a legitimate payment terminal can silently redirect a user to a credential-harvesting page or malware download.
Common warning signs in QR-decoded URLs include:
- Raw IP address — legitimate services use domain names, not IP addresses like
http://192.168.1.1/login. - URL shorteners — services like bit.ly hide the real destination. Inspect the final URL before opening.
- HTTP instead of HTTPS — any login or sensitive page served over HTTP is a strong warning sign.
- Punycode hostnames — domains like
xn--pypl-p9ab.commay visually resemble legitimate brands when rendered. - Unexpected domain — a QR code on bank materials linking to a non-bank domain should always be questioned.
The risk hints in this tool flag these patterns automatically. They are heuristic signals — not a malware verdict — and should be used alongside your own judgement. When in doubt, do not open the link on a device you care about.
What this tool helps with
Good uses
- Reading QR codes from screenshots on a laptoppaste a screenshot containing a QR code and decode it instantly without needing a phone. The fastest workflow for desktop users.
- Inspecting suspicious QR codes before openingdecode the payload and review URL risk signals — IP addresses, URL shorteners, punycode — before scanning on a device.
- Extracting Wi-Fi credentials from a QR codedecode Wi-Fi QR codes to see the SSID, security type, and password as plain text — useful when sharing credentials with a guest or adding a new device.
- Reviewing QR codes in marketing materialsverify that print campaign QR codes point to the correct destination before the material is distributed.
- Checking crypto wallet QR codesdecode Bitcoin, Ethereum, or other crypto payment URIs to verify the wallet address and amount before sending a transaction.
- Saving contact cards from QR codesextract vCard and MeCard contact details — name, phone, email, address — from a QR code on a business card or badge.
Limitations to know
- Definitive malware detectionURL risk hints are heuristic signals based on observable patterns. This tool does not scan URLs against threat intelligence feeds or malware databases. Use a dedicated security scanner for authoritative verdicts.
- Blurry or very small QR codesjsQR requires sufficient resolution and contrast to decode correctly. If the tool reports no QR found, try a higher-resolution screenshot or crop more tightly around the QR code.
- Proprietary or encrypted QR formatssome industries use proprietary QR variants or encrypted payloads. This tool decodes standard QR codes only and will show the encrypted or opaque payload as raw text.
- Validating that a decoded URL is reachablethis tool decodes QR structure only. It does not make network requests. Use the HTTP Headers Checker to verify whether a URL responds correctly.
How to decode and inspect a QR code
- 1
Provide the QR code image
Drag and drop an image onto the upload zone, click to browse for a file, paste a screenshot with Ctrl+V or Cmd+V, or click Start camera for live scanning. Camera access is requested only when you click Start and runs entirely locally.
- 2
Review the detected payload type
The tool identifies the payload type automatically — URL, Wi-Fi, vCard, MeCard, email, SMS, geo, crypto wallet, or plain text — and shows the type label with an icon.
- 3
Check URL risk signals if applicable
For URL payloads, the risk banner shows whether any caution signals were detected: raw IP address, HTTP link, URL shortener, punycode hostname, or unusual length/encoding. Green means no obvious signals. Amber or red means review carefully.
- 4
Read the parsed structured view
The parsed details panel breaks the payload into readable fields — Wi-Fi network name and password, vCard contact fields, email recipient and subject, GPS coordinates, or URL components. Copy any field individually.
- 5
Take action safely
Copy the raw payload or individual values. Send a URL to the URL Parser for deeper inspection. Open any link manually only after reviewing it — the tool never auto-opens links.
Common issues and how to fix them
No QR code found in this image
The most common cause is insufficient resolution or low contrast. Try taking a higher-resolution screenshot, cropping tightly around just the QR code, or increasing screen brightness before capturing. The jsQR library requires clear module edges to decode reliably.
Camera permission was denied
The browser requires explicit camera permission. Check the address bar for a camera blocked icon, click it to allow access, and refresh the page. On mobile, check Settings → Browser → Camera permissions.
The decoded URL is heavily encoded or looks garbled
Some QR codes contain percent-encoded or base64-encoded URLs. Copy the raw payload and use the URL Parser tool to decode and inspect the query string. This is common with campaign tracking links and app install QR codes.
Caution or warning flags appeared but I trust the source
Risk signals are heuristic hints, not verdicts. A URL shortener or long query string is not automatically malicious. Review the signals, open the URL Parser to inspect the full structure, and make your own assessment before opening the link.
Wi-Fi QR decoded but connecting still fails
Verify the SSID and password fields are correct. Some routers use case-sensitive passwords. If the QR was generated with special characters in the password, copy the Password field from the parsed view rather than typing it manually.
vCard data shows blank fields
Different vCard generators use different property names and encodings. If a standard field like FN or TEL is blank, the source may use a non-standard key or CHARSET encoding. Copy the raw payload and inspect the full vCard text manually.