# QR Code Reader — Decode and Check a Code Before You Scan It

> Decode a QR code from an image or your camera, and check the link before you open it.

To read a QR code, drop in an image, paste a screenshot, or point your camera at one — it decodes in the page and nothing is uploaded. The decoded content is then checked structurally: whether a link uses HTTPS, whether the hostname is punycode that could be a lookalike, whether it is a shortener hiding the real destination, whether a brand name sits in a subdomain rather than the actual domain, and several more. Reading a code before your phone acts on it is a genuine safety step, because a QR code gives no visual clue about where it leads.

**URL:** https://convertto.tech/t/qr-code-reader
**Category:** QR & Barcodes (https://convertto.tech/c/qr-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Camera, decode and analysis all run in the page — nothing is uploaded
- **Checks:** Structural only: no reputation lookup, so nothing is sent anywhere
- **Input:** Drop, paste, pick several at once, or scan live with a camera
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Drop an image, paste a screenshot, or start the camera.
2. Read what the code contains and what scanning it would do.
3. Check the flagged issues before opening anything.

## FAQ

### Why read a QR code instead of just scanning it?

QR codes are unreadable to humans, which is exactly what makes "quishing" work — a sticker placed over a genuine code on a parking meter or a restaurant table looks identical to the real thing. Decoding it first shows the real destination before you visit it.

### Why is my code not detected?

Usually blur, glare, a steep angle, or a cropped quiet zone — the blank margin around the pattern has to be intact for a code to be found at all. This tool also retries at reduced scale and with a hard black-and-white threshold, which recovers most photographs that fail on the first pass.

### What is a lookalike hostname?

Only the part immediately before the top-level domain decides where a link goes. In paypal.com.secure-login.ru the site is secure-login.ru, not PayPal — everything to the left is chosen freely by whoever owns that domain. The check flags a known brand name appearing anywhere except the registrable domain.

### What is punycode and why is it flagged?

It encodes non-Latin characters in a hostname, which is entirely legitimate for most of the world's languages. It is also how a lookalike domain is built, because several Cyrillic and Greek letters render identically to Latin ones — so the domain you read may not be the domain you reach.

### Is my camera feed or image sent anywhere?

No. The camera stream is read frame by frame into a canvas in the page, the decode runs on those pixels locally, and every safety check is computed from the decoded text itself. There is no reputation service, so nothing about the code you scanned leaves your browser.

## Sources

- [RFC 3492 — Punycode](https://www.rfc-editor.org/rfc/rfc3492) — IETF
- [FBI warning on malicious QR codes](https://www.ic3.gov/PSA/2022/PSA220118) — FBI IC3

## Related tools

- [Barcode Reader](https://convertto.tech/t/barcode-to-text): Read a code from a photo, a screenshot or your camera, entirely in your browser.
- [QR Code to Text](https://convertto.tech/t/qr-to-text): Pull the raw text, link or data out of a QR code image, and check it before you act on it.
- [Business Card QR to vCard](https://convertto.tech/t/business-card-to-vcard): Decode the QR code on a business card and save the contact as a .vcf file for any address book.
- [QR Code Generator](https://convertto.tech/t/qr-code-generator): Design QR codes with custom shapes, gradients and a logo, and check they will still scan.
- [vCard Generator](https://convertto.tech/t/vcard-generator): Build a contact card with several numbers and addresses, and get the .vcf plus a scannable QR.
- [Email Header Analyzer](https://convertto.tech/t/email-header-analyzer): Paste raw email headers to map the delivery path, time every hop and read the SPF, DKIM and DMARC results the receiving server recorded.
- [Punycode Converter](https://convertto.tech/t/punycode-converter): Convert internationalised domain names to Punycode and decode xn-- domains back.
- [Base64 to File Converter](https://convertto.tech/t/base64-to-file): Decode Base64, a data URI or hex back into a downloadable file, with the type detected automatically.