{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }} {{ badge.value }}

{{ selectedFile ? selectedFile.name : 'Drop or paste one QR image' }}
Click to browse, or paste a screenshot while this area is focused.
{{ sourceDimensionsLabel }} · {{ formatBytes(selectedFile.size) }}
{{ fileStatus }}
Choose the source before adding one QR image. Only the first usable item is processed.
Remote URLs are fetched by your browser and can fail CORS pixel access. Upload the saved image when that happens.
{{ textSourceStatus }}
Keep upright for screenshots; add rotations only for uncertain camera orientation.
Adds 85% and 70% raster passes after the original scale.
{{ try_harder ? 'Three scale passes' : 'Base scale only' }}
Adds one light-on-dark pass for every configured angle and scale.
{{ try_inverted ? 'Normal + inverted' : 'Normal colors only' }}
Use 0 for original size; 1600 px is a practical retry for oversized screenshots.
px
Use 0 for no additional timeout, or 3000–8000 ms for remote images.
ms

Recovered payload

{{ resultValues.safety_label }}
{{ decodedSuccessfully ? resultValues.payload_text : resultValues.error_message }}

{{ resultValues.safety_detail }}

FieldValueReview noteCopy
{{ row.label }}{{ row.value }}{{ row.note }}
CheckStatusDetailSuggested actionCopy
{{ row.label }}{{ row.status }}{{ row.detail }}{{ row.action }}
Quick Response (QR) Code Generator Create a QR code for links and common actions with payload-capacity and contrast checks plus quiet-zone, logo, and scan-readiness guidance.
QR Batch Generator Generate named QR images from pasted rows or CSV/TXT files, then catch capacity and scan-readiness risks before downloading the batch.
QR Label Sheet Generator Create printable QR label sheets from CSV or text rows with stock presets and placement planning plus density warnings and local processing.
Uniform Resource Locator (URL) Decoder Decode percent-encoded URLs or text, inspect characters and query structure, and clean trackers or duplicate parameters without fetching the destination.

The square pattern is only the transport. The recovered payload may be plain text, a website, a contact card, a Wi-Fi setup string, a phone action, or an authenticator secret. Decoding the symbol before acting exposes that difference.

A Quick Response (QR) symbol arranges data and recovery information in a grid of light and dark modules. Large finder patterns establish orientation, alignment features help with distortion, and a quiet zone separates the symbol from surrounding artwork. Error correction can recover some damage, but it cannot compensate for every blur, crop, reflection, perspective change, or low-contrast design.

Image quality and payload safety are separate questions. A perfectly readable code can point to a spoofed login page or contain a secret. An unreadable code may simply be too small, sideways, inverted, over-compressed, tightly cropped, or missing enough quiet zone for the detector to locate it.

PayloadPossible actionReview before continuing
Web URLOpen a browser destinationHost spelling, HTTPS, redirects, punycode, private hosts, and embedded credentials
OTP setupAdd an authenticator accountThe provisioning URI may contain an account secret
Wi-FiJoin a networkNetwork name, security mode, and password exposure
Email, phone, SMS, or mapStart a device actionRecipient, number, location, and prefilled content
vCard or MeCardImport a contactEvery personal-data field before saving or sharing

How to Use This Tool:

Begin with the smallest scan plan that fits the image, then add retries only when the first pass cannot recover a payload.

  1. Choose Local image file and add one PNG, JPEG, WebP, GIF, or SVG image. Use the text-source mode only for a direct image URL, a data-image URI, or raw base64 PNG data.
  2. Select Decode QR with the upright, original-scale defaults. A decoded result opens Payload review; a failed search reports that no payload was found in the configured plan.
  3. If the image is sideways, select a wider Rotation search. Add Extra scale passes for a small or compressed symbol and Inverted-color pass for light modules on a dark background.
  4. For a very large screenshot, set a Longest-edge cap to create a smaller base raster. Then decode again and compare the winning angle, scale, polarity, and attempts in Search effort.
  5. Read the recovered text and Safety review before selecting Open link. Confirm a URL independently when the host is shortened, private, encoded as punycode, or otherwise unexpected.

Interpreting Results:

A decoded payload proves that one raster pass produced text. It does not prove that the text is benign, that a URL reaches the visible host after redirects, or that an OTP or Wi-Fi value is safe to share. HTTPS link means only that the parsed URL uses HTTPS and avoids the specific local warning rules.

The safety labels are focused cues. Sensitive OTP, Wi-Fi secret, and Credentials in URL call for restricted handling. HTTP link, Private host, Punycode host, and Short link call for verification. Plain text receives no open action, but its contents can still be deceptive.

A no-payload result is not proof that the image contains no QR code. It means every configured angle, scale, and polarity was tried without a successful decode. A sharper image, more quiet zone, a tighter but complete crop, or another scanner may still succeed.

Technical Details:

The source image is decoded into pixels and optionally reduced so its longest edge does not exceed the requested cap. Each configured scale is rasterized at every configured quarter-turn angle. Normal polarity is tried first, followed by an inverted pass when enabled. Each pass is offered to two QR decoders before the search advances.

Formula Core:

The maximum number of raster attempts is the product of angles, scales, and polarities.

Nattempt=Nangle×Nscale×Npolarity

Upright mode has one angle, left/right mode has three, and all-quarter-turn mode has four. Extra scale passes change the scale count from one to three by adding 85% and 70% rasters. Inversion changes the polarity count from one to two. The largest plan is therefore 4 × 3 × 2 = 24 attempts.

Transformation Core:

  1. Resolve a local file, direct HTTP(S) image, data-image URI, or raw base64 PNG source and require dimensions from 1 to 16,384 pixels per side.
  2. Apply the optional longest-edge cap, then create scale, rotation, and polarity passes in a deterministic order.
  3. Stop at the first successful decoder result and record recovered text, decoder, angle, effective scale, polarity, byte or bit metadata when available, and attempts used.
  4. If the full budget is exhausted, return a no-payload result rather than empty decoded text.

Rule Core:

Payload classification recognizes web and FTP-style URLs, email, phone, SMS, geographic, OTP, Wi-Fi, MeCard, vCard, other URI schemes, and plain text. Only HTTP and HTTPS destinations become openable links. Safety review follows the first matching rule below.

MatchResult
OTP or Wi-Fi payloadSensitive content warning
HTTP(S) URL with username or passwordCredentials in URL warning
Non-HTTPS web URLHTTP link review
Localhost, private IPv4 range, link-local address, or internal-looking hostPrivate host review
Punycode or known shortener hostLookalike or redirect review
Other HTTPS URLHTTPS link, with host confirmation still required
Device action or contact cardRecipient or personal-data review
Other textText payload

Local files are limited to 25 MiB, decoded payloads to 32,768 characters, and load timeout to 0 to 60,000 milliseconds. A zero timeout adds no timer. The source-text field accepts up to 2,000,000 characters, while the decoded image dimensions remain bounded separately.

Privacy and Safety Notes:

Local image files are read and decoded in the browser; their pixels are not uploaded by this workflow. A direct remote URL is requested by the browser from that host and can expose ordinary network request information. Cross-origin rules may also prevent readable pixel access, in which case saving and loading the image as a local file is the safer recovery path.

The safety review does not visit destinations, expand redirects, test reputation, scan downloads, or detect every deceptive domain. Treat OTP and Wi-Fi payloads as secrets, and verify unexpected URLs through a known contact method before opening them.

Worked Examples:

Authenticator setup code

An otpauth: payload is classified as OTP and receives Sensitive OTP. Even when the image decodes cleanly, do not paste the recovered URI into chat or a ticket because it may contain the account provisioning secret.

Sideways dark-mode screenshot

Choose all quarter turns, extra scale passes, and inverted color only after the upright pass fails. That creates a 24-attempt budget. A hit at 90°, 85% scale, and inverted polarity identifies the successful recovery path; it does not change how the payload itself should be judged.

References: