Camera, upload, or paste
Camera mode asks for the rear-facing camera at up to 1280x720 and scans continuously, checking every video frame until it finds a code. Upload mode reads a chosen or dropped image file (PNG, JPG, GIF, WebP, up to 20MB) and runs it through a short enhancement pass: the original image first, then a black-and-white contrast version, then a 2x upscale if the image is smaller than 400 pixels on either side. Clipboard paste (Ctrl+V, or Cmd+V on a Mac) works from anywhere on the page and decodes a copied screenshot the same way as an uploaded file.
If an upload does not decode, the repair tool runs a deeper 7-step image-enhancement pipeline across two decoder engines, built for blurry, faded, or partially damaged QR codes that this scanner's lighter pass cannot recover.
Advertisement
What it recognizes
The scanner parses the decoded text into one of 8 content types and shows the relevant fields instead of raw text:
- URL: any http:// or https:// link, with a one-click Open Link action and the safety check below.
- WiFi network: SSID, password, encryption type, and hidden-network flag, parsed from the WIFI: format.
- Contact card (vCard): name, phone, email, and organization fields.
- Phone number: from a tel: link, with a one-tap Call action.
- Email: from a mailto: link, with a one-tap Send Email action.
- Bitcoin payment: the wallet address from a bitcoin: URI.
- Location: latitude and longitude from a geo: URI, with a one-tap Open Map action.
- Plain text: anything that does not match one of the formats above.
The safety check on URLs
Every scanned URL is checked against a short list of heuristics before you tap Open Link. Each match adds a reason to the warning shown under the result:
- Uses unencrypted HTTP instead of HTTPS.
- Uses a known URL shortener (bit.ly, tinyurl.com, ow.ly, goo.gl, t.co, short.link, is.gd, buff.ly, adf.ly, rb.gy, or cutt.ly), which hides the real destination.
- Points to a raw numeric IP address instead of a domain name.
- Uses a top-level domain associated with disposable or low-cost registrations (.tk, .xyz, .top, .site, .space, .stream, .loan, .click, .gq, .ml, .cf, .ga).
Zero matches shows a green "Looks Safe" badge. One match shows a yellow "Caution" badge. Two or more matches shows a red "Suspicious" badge. This is a heuristic, not a guarantee: a legitimate link can trip one of these checks (a company that uses a shortener for tracking, for example), and a malicious link can avoid all of them. Read the destination hostname shown under the result before trusting any scanned link.
History stays on your device
The History tab keeps your last 20 scans in your browser's localStorage, never on a server. Duplicate scans are merged into one entry. Before anything is saved, sensitive fields are stripped: a WiFi network's password field is replaced with a placeholder, and a vCard's phone, email, address, and note fields are redacted, so even your own local history does not retain scanned secrets. Clear History deletes the stored list immediately, and it also disappears if you clear your browser's site data.
Frequently Asked Questions
Do I need to install an app to scan QR codes?
No. This scanner runs entirely in your browser. Open link2qr.com/scanner and use your camera, upload an image, or paste from your clipboard. No downloads required.
Is it safe to scan QR codes with this tool?
Yes. The scanner includes a built-in safety check that flags suspicious URLs before you visit them. All processing happens locally in your browser, no images or data are sent to any server.
Can I scan a QR code from a screenshot or saved image?
Yes. Click the upload tab to select an image from your device, or use the clipboard tab to paste a screenshot directly. The scanner decodes QR codes from any standard image format.
What types of QR codes can this scanner read?
This scanner decodes all standard QR code types including URLs, plain text, WiFi credentials, vCard contacts, phone numbers, email addresses, locations, and Bitcoin payment addresses.
Does this scanner store my scanned data?
Only in your own browser's localStorage, capped at 20 recent scans, with sensitive fields like WiFi passwords redacted before they are saved. Nothing is ever sent to our servers.