Read a QR code from a picture

What the decoder tells you about the code

Decoding a QR code is arithmetic rather than recognition, so the result comes with facts about the symbol as well as its contents — including the error-correction level the code was made with. That is a small thing that occasionally matters: a code produced at the lowest level has about seven per cent redundancy and will stop reading after very little wear, which is worth knowing if you are about to reprint somebody else's artwork rather than generate your own. Up to thirty-two symbols are found in one picture, identical results across the search passes are merged, and anything the decoder itself marks as not valid is thrown away rather than shown to you as a guess.

The text is then interpreted, and two of the checks are the reason to read a code here instead of pointing a phone at it. A web address whose host mixes alphabets, or carries a punycode label, is flagged — that is the shape of a domain spelled with a Cyrillic character that looks exactly like a Latin one, which is not something you can see by reading the link. A plain, unencrypted address is flagged separately, with the advice not to type a password or a card number into it. Only http and https addresses are turned into links at all; a payload using any other scheme is shown to you as text and stays text.

Beyond links, the page recognises Wi-Fi credentials, vCard and MeCard contacts, calendar events, mail, telephone and text-message payloads, a map point, a retail product number and a one-time-password secret — the kind used to set up two-factor authentication, which is a genuinely good reason for a decoder not to involve a server. A product number whose check digit does not agree with the rest is flagged as probably misread rather than reported as a fact. A Wi-Fi code is parsed with the escaping rules the format specifies, so a password containing a semicolon survives intact, and an open network with no password at all is called out.

When you want something else

The search is three passes deep and then it stops. A code that is a small part of a large photograph, badly out of focus, or missing more than error correction can rebuild will not be recovered by trying again — take the picture again instead, closer and squarer, filling more of the frame. There is no camera here and no live scanning, which is the one thing a phone does better; if the code is physically in front of you, the phone's own camera app will read it, and this page is for the screenshot, the PDF and the photograph you were sent.

For anything repeated — a folder of tickets, a sheet of labels, a batch of scanned forms — this is one picture at a time and the job is a command. ZBar's zbarimg reads codes out of image files from a shell loop and prints what it found, and Python's pyzbar does the same inside a script. Both are free, both handle a thousand files without a thousand clicks, and neither of them checks the things this page checks, so a batch decode is a decode and the judgement about a suspicious address remains yours.