What the decoder looks for in the image
A QR code is a grid of dark and light modules with three large finder squares in its corners. The decoder locates those squares, works out the grid's size and tilt from them, samples each module, reads the format bits that say which error correction level and mask were used, and applies Reed-Solomon correction to recover the data even when part of the pattern is damaged.
This scanner tries the image both as printed and with the colours inverted, so white-on-black codes decode too. Photos larger than about 1600 pixels on their longest side are scaled down before decoding, which costs nothing in accuracy because each module is still many pixels wide, but makes the search much faster on a phone.
Reading the result card
The label at the top of the result comes from the first characters of the payload: WIFI: is a Wi-Fi login, BEGIN:VCARD a contact card, mailto: an email, tel: a phone number, SMSTO: or sms: a text message, geo: a map coordinate, and http:// or https:// a link. Anything else is shown as text, including a web address typed without its scheme, which gets no Open link.
Below the label sits the raw payload exactly as encoded, in a monospace box, with a Copy raw button. For a link you also get Open link, which opens in a new tab. For a Wi-Fi code the fields are separated out and the password gets its own copy button. There is no history: reload the page and the result is gone.
Why a scan fails and what to change
The message No QR code found means the finder squares could not be located. The usual causes are motion blur, glare from a glossy surface, a code that is too small in the frame, or a crop that removed the quiet zone, the blank margin the decoder needs around the pattern. Retake the photo closer and squarer, with light coming from the side rather than straight on.
Screens are harder than paper: moire from photographing a monitor, a dark-mode inversion and a dim display all confuse the decoder. Take a screenshot instead of a photo when the code is on the same device, or turn the brightness up on the other one. A file that is not a readable image gets its own error rather than a fruitless search.
QR phishing and how to check a link
Quishing is phishing through QR codes: a sticker over the real code on a parking meter, a poster offering a prize, or an email that asks you to scan a code because the link itself would be caught by a filter. The scan looks harmless, and most phone cameras open the page with the address barely visible.
This scanner never opens anything by itself. Read the domain in the raw payload: a lookalike such as paypa1.com, an unexpected country code, or a link shortener that hides the destination are all reasons to stop. The phishing link checker scores the domain's age, blocklist status and page content from the server, so nothing is loaded in your own browser.
Camera access, HTTPS and privacy
Live scanning uses the browser's camera API, which only works on a secure (HTTPS) page. On a plain http:// address the Use camera button reports that camera access is not available. The first click asks for permission, and the scanner requests the rear camera on phones. If permission is refused, the message tells you to allow it in the browser settings or upload a photo instead.
While the camera runs, a frame is examined about five times a second, and the stream is switched off the moment a code is read or when you press Stop camera. Frames go onto a canvas in the page and nowhere else, so the feed is never recorded or transmitted. Uploaded images are handled the same way.