What the scanner tells you about a code
A QR code is only a picture of some text. What makes it useful is that phones recognise the shape of the text and offer to act on it. This scanner does the first half and leaves the decision to you: it works out what the text is, and shows it in plain words.
- Web link: the full address, with the site name in bold, and a button that opens it in a new tab when you click.
- Wi-Fi network: the network name, the password (hidden until you show it), the security type and whether the network is hidden. A web page cannot join a network for you, so you copy the details.
- Contact card: the name, numbers, email, website and address from a vCard or MECARD. A vCard comes with a button to save a .vcf file. A MECARD shows its details for you to copy, with no file to save.
- Email, text message and phone number: who it goes to and what it says. The buttons open your own email, messaging or phone app, which waits for you to press send or call.
- Map location: the coordinates, with a link that opens OpenStreetMap on that spot.
- Calendar event: the title, start, end and place, with a button to save a .ics file.
- Payment request and login app setup: UPI, bitcoin style and other payment codes, and the secret key that sets up a login (authenticator) app. These come with a clear warning.
- Anything else: shown as text that you can copy.
Before you open a link from a QR code
Scanning a code only reads text, so scanning is not the risky part. The risk starts when you open a link, join a network or pay. A QR code is as trustworthy as whoever put it there, and printed codes can be covered by a sticker with a different one. Look at where the code is before you trust it.
The scanner points out the usual tricks:
- A short link. Services such as bit.ly hide the real destination until you open it.
- http instead of https. The connection is not encrypted.
- An address that is only numbers. Honest sites nearly always have a name.
- Text before an @ sign. In an address, everything before the @ is a user name, not the site, and it is used to make a link look like another site.
- Letters from other alphabets. Some Cyrillic or Greek letters look the same as Latin ones, so an address can look like a well known site and be another. The scanner shows what such an address reads as in its own letters.
- Hidden characters. Zero width characters and text direction marks are shown as codes so they cannot hide in the text.
For banking, shopping accounts and anything with a password, it is safer to type the site's address yourself than to follow a code.
When a picture will not scan
The scanner first uses your browser's own detector where there is one. It then reads the picture with a decoder that runs in this page, which loads from this site the first time you scan (a file of about 1 MB). That decoder looks at the picture at up to 3,200 pixels on its long side, tries the colours flipped, and finds up to 100 codes in one go. If nothing is found, a second, simpler reader tries the whole picture at a few sizes, because a blurred code reads better shrunk and a small code in a big photo needs the full size. It then tries four overlapping quarters and, for a large picture, small tiles at full resolution. A picture saved with a transparent background is read over white, and if that finds nothing, over black.
If it still finds nothing, the cause is usually one of these:
- The code is too small or blurred. As a rule of thumb each square of the code needs to be at least 3 or 4 pixels wide. Crop the picture closer or take a new one.
- The blank border around the code is missing or cut off, or part of the code is outside the picture.
- Glare, a strong shadow or a curved surface breaks up the squares.
- The code is damaged or covered too much. QR codes can repair some damage, but not all of it.
- It is not a QR code. Barcodes on products, Data Matrix, Aztec and PDF417 are different formats that this scanner does not read.
Scanning with the camera, and what stays private
The camera is not touched until you press the button, and your browser asks for permission first. Camera access needs a secure page (https). The scanner looks at the live frames in this tab only. Nothing is recorded, saved or sent, and the camera turns off when a code is found, when you press stop, and when you switch to another tab.
Where your browser has a built in barcode detector, the scanner uses it, and otherwise it uses its own software decoder. Both run on your device. A phone's own camera app is often faster for a quick scan, but it will not show you the warnings above or let you copy the text.