QR code reader (read a QR code from a picture)

A clear answer. Here’s how.

Reads one QR code from a picture file (PNG, JPEG, WebP, GIF, BMP, SVG or anything else this browser can open). The picture is drawn on a canvas on this device and decoded by jsQR, an open-source (Apache-2.0) reader that your browser downloads only when you use this tool. Each scan tries normal colours and then inverted ones. The first scan is of the picture reduced to 2,000 pixels on its long side (or as it is, if smaller); if no code is found it scans at full size (up to 36 million pixels, or 4,000 pixels beyond that), then at 1,000 pixels, stopping early if the scans are taking more than 20 seconds, and then gives up. A picture over 100 million pixels is refused, because decoding it could exhaust the browser’s memory, and transparent areas count as white. An SVG is drawn at 1,000 pixels on its long side by the sizing rules of the SVG to PNG tool. The text is rebuilt from the code’s own segments: UTF-8 unless the code declares another character set (an ECI number) or the bytes are not valid UTF-8, in which case they are read as ISO-8859-1, the QR standard’s default, with a warning. The text is then recognised by its shape, using the formats in the ZXing project’s Barcode Contents page (WIFI:, MECARD, sms, geo), NTT DoCoMo’s MECARD and MATMSG, vCard (RFC 6350 and 2426), mailto, tel, sms and geo (RFC 6068, 3966, 5724 and 5870) and Google’s Key URI Format (otpauth://). Nothing it reads is ever opened, fetched or followed: a web address is shown as text with its host name on a line of its own, and a host with letters outside plain ASCII (which browsers write as xn-- Punycode, RFC 3492) is flagged with its Unicode form and the script of each odd character, because lookalike letters are a common trick. A Wi-Fi password and an otpauth secret key are hidden unless you ask to see them, and an otpauth code carries a warning because its key lets anyone generate your login codes. Also shown: the number of characters and data bytes, the QR version and data modes, the corners of the code in the picture in pixels, how far it is turned and how many pixels one dot (module) covers. This tool reads QR codes only, and only the first one jsQR finds in a picture: not barcodes, Data Matrix, Aztec or Micro QR, and not several codes in one picture. It does not use the camera (this site’s Permissions-Policy turns the camera off on purpose): take a photo or screenshot, then choose the file. Failing to read a code does not mean the code is invalid, because blur, glare, low contrast, tiny dots or a cut-off corner stop this reader and another may succeed. One case is known: jsQR 1.4.0 cannot read version 23 symbols at error-correction level L (a typo in its alignment-pattern table; the same symbols pass an independent Reed–Solomon check), and these are rare, large codes. Reading a code does not mean what it says is safe.