Scan a QR Code
Point your camera at a code, or upload a photo or screenshot. Everything is decoded in your browser — the image never leaves your device.
You can also drag an image here, or paste a screenshot with Ctrl+V / Cmd+V.
Decode a QR Code Without Opening It
Decode any QR code and read its raw contents without opening the link. Upload an image or use your camera to reveal the exact URL, Wi-Fi credentials, contact details, or text encoded in the code. Runs entirely in your browser — nothing is uploaded.
Quick Answer
To decode a QR code without opening it, upload the image or point your camera at it above. The exact encoded contents appear as plain text — the full URL, the Wi-Fi network name and password, the contact details, or whatever else the code carries — and nothing opens automatically. Decoding happens in your browser, so the image is never uploaded, and you can read the destination before deciding whether to trust it.
How to decode a QR code safely
- 1
Step 1: Get the code as an image — photograph it, screenshot it, or save the file.
- 2
Step 2: Upload it above, drag it onto the page, or paste it with Ctrl+V. You can also use the camera without anything opening automatically.
- 3
Step 3: Read the decoded contents. We show the raw text exactly as encoded, with no shortening or prettifying.
- 4
Step 4: Check the payload type we label it with. A code that claims to be a menu but decodes as a Wi-Fi join or a payment request is a warning sign.
- 5
Step 5: For a link, read the hostname — the part before the first single slash. Everything after it can be crafted to look reassuring.
- 6
Step 6: Treat shortened links as unknown. We flag them, because a bit.ly address tells you nothing about where it actually goes.
- 7
Step 7: Only then decide whether to open it. Nothing happens until you choose to.
A QR code is text, and text can lie
There is nothing intelligent inside a QR code. It is a way of writing a short string of characters as a pattern of black and white squares, and the string can be anything: a web address, a Wi-Fi password, a phone number, a calendar event, a payment request, or plain text. The pattern gives you no clue which.
That is the entire basis of QR-based fraud. A sticker printed with a code pointing at a lookalike payment page, placed over the real code on a parking meter, is visually indistinguishable from the genuine article. The victim's phone opens the link before they have had a chance to read where it goes. Decoding first removes that gap.
What a decoder shows you that a camera does not
- •The complete raw string, not a truncated preview. Phone camera banners often cut off long URLs at exactly the point where the deception lives.
- •The payload type — website link, Wi-Fi network, contact card, calendar event, phone number, SMS, crypto payment, two-factor seed, or plain text.
- •The real hostname for a link, displayed separately, because that is the only part of a URL that cannot be faked.
- •A warning when the link is shortened, since a shortener deliberately conceals the destination.
- •No automatic action. Nothing opens, nothing joins a network, nothing is added to your contacts until you choose it.
Reading a URL properly
Most people scan a URL left to right and stop when they see something familiar. Attackers rely on this. In 'https://apple.com.secure-login.xyz/verify', the actual host is secure-login.xyz — 'apple.com' is just a subdomain label placed there to be recognised.
The rule is simple: find the first single slash after the protocol, then read backwards from it. The last two labels before that slash are the real domain. Everything before them is a subdomain anyone can create, and everything after the slash is a path the site owner controls entirely.
Codes worth decoding before acting on
Not every code needs this treatment — a menu in a restaurant you chose to walk into is low risk. These are the ones where checking first is worth the ten seconds.
- •Anything asking for payment: parking meters, EV chargers, invoices, donation posters. Payment codes are the most heavily targeted category.
- •Codes that arrive unsolicited by post, email, or as a flyer, especially ones citing a deadline or a penalty.
- •Codes leading to a login page for a bank, an employer, or a delivery service.
- •Wi-Fi codes in public places, which can silently join you to a network someone else controls.
- •Any code that has been stuck on top of another one. If you can see or feel a sticker edge, do not scan it.
Everything stays on your device
Decoding runs in your browser. The image is drawn to an off-screen canvas, the pixels are read locally, and the pattern is resolved on your own machine. Nothing is transmitted, stored, or logged — not the image, not the decoded text, not the fact that a decode happened.
This is a functional requirement rather than a policy choice. Decoding a two-factor authentication seed or a Wi-Fi password through a service that uploads your image would hand over exactly the secret you were trying to inspect. Disconnect your internet after this page loads and the decoder still works.
Free, private, and permanent
WebsitesQR runs entirely in your browser. Codes you create are static and never expire; images you scan are never uploaded. Learn about QR code safety →
Frequently Asked Questions
How do I see what a QR code contains without opening it?
Upload the image or use the camera above. The full encoded text appears as plain text and nothing opens automatically — you read the destination first and decide afterwards.
Can a QR code contain a virus?
Not directly. A QR code holds only text, so it cannot execute anything by itself. The danger is what the text points at: a phishing page, a malicious download, a payment request, or a Wi-Fi network under someone else's control. Reading the text first is what protects you.
How do I check if a QR code is safe?
Decode it here, then read the hostname — the part immediately before the first single slash. Confirm it is the organisation you expect, be suspicious of lookalike spellings and extra words, and treat shortened links as unknown destinations. Also check the payload type matches what the code claims to be.
What is the difference between a QR decoder and a QR scanner?
In practice, emphasis. A scanner is built to act on the code quickly and often opens the link immediately. A decoder is built to show you the contents and stop there. This tool does both, but never opens anything without you choosing to.
Can I decode a Wi-Fi QR code to see the password?
Yes. Wi-Fi QR codes store the network name, security type, and password as plain text in a standard format. Decode the image here and the credentials appear in full — useful when you have the code on a router card but need to type the password manually.
Is the decoded data sent anywhere?
No. Everything is processed by your browser on your own device, and neither the image nor the decoded text is transmitted or stored. Turn off your internet connection after this page loads and it still works, which is the simplest proof.
Can ChatGPT decode a QR code for me?
No, and it is worth being explicit about this because people try. AI assistants can describe an image containing a QR code but cannot resolve the module pattern into its data, and will often produce a confident, entirely invented URL. Decode it here to get what the code actually says.