What the QR code payload decoder extracts
The QR code payload decoder reads the raw text stored inside a QR code from an image you upload, shows it exactly as encoded, and breaks recognized formats into labeled fields, without opening a link, joining a network, or running anything.
The decode happens in your browser with the jsQR library. If the first pass fails, it retries assuming an inverted (light-on-dark) code. The image and the data it holds never leave your device.
The nine formats it parses
Every payload is shown in full in the Raw Extracted Data String box. On top of that, these prefixes trigger a Parsed Data Fields table with a Copy button on each row:
| Detected type | Triggered by | Fields it breaks out |
|---|---|---|
| Web URL | http://, https://, www. | URL destination, plus a "Verify Safety in Security Scanner" button |
| Wi-Fi Network | WIFI: | SSID, security type, password (masked, with a Show toggle), hidden-network flag |
| vCard Contact | BEGIN:VCARD | Full name, organization, job title, phone, email, website, notes |
| EPC SEPA Bank Transfer | BCD followed by a newline | Transfer type, BIC/SWIFT, beneficiary name, IBAN, amount, reference, remittance info |
| SMS Message | smsto:, sms: | Phone number, pre-filled message |
| Email Prompt | mailto: | To address |
| Geo Location | geo: | Coordinates |
| Cryptocurrency Payment | bitcoin:, ethereum: | Wallet address |
| Raw Text / App Data | anything else | Shown as-is in the raw box |
Everything else shows as raw text
Formats without a parser (MECARD contacts, calendar events (BEGIN:VEVENT), authenticator codes (otpauth://), tel:, UPI and other payment URIs, app deep links) are still decoded and shown in full; they just don't get the field table. You see the exact string either way, which is the point.
Example: decoding a café Wi-Fi code
You photograph the Wi-Fi code taped to the counter and drop the photo into the tool. The Decoded Payload panel opens, the badge reads Wi-Fi Network, and the raw box shows:
WIFI:S:Cafe Guest;T:WPA;P:latte-2026;H:false;;The tool strips the WIFI: prefix, splits on the semicolons, and reads each pair into the table:
| Field | Value |
|---|---|
| SSID (Network Name) | Cafe Guest |
| Security Type | WPA |
| Password | •••••••• (press Show to reveal latte-2026) |
| Hidden Network | No |
Press Copy on the Password row to paste it into a laptop or desktop that can't scan a code itself; a typical reason to decode a Wi-Fi QR rather than point a phone at it.
Using it to check a suspicious code
Say a sticker over a parking sign decodes to:
https://your-bank.example.verify-login.top/authThe badge reads Web URL, and the parsed row prints the address as text and as a link you can choose to open; the tool never opens it for you. Read the actual host: the real domain here is verify-login.top, not your-bank.example, which sits in front of it only to look reassuring. The Verify Safety in Security Scanner button carries the URL straight to the QR Code Security Scanner for a reputation check.
Reading the payload tells you what a code contains, not whether the destination is safe. For a link, check the domain yourself, run it through the Security Scanner, and if anything looks off, don't open it. For a Wi-Fi or payment code, confirm the details match what you expected before you use them.
Who uses this
- Anyone who spots a code that looks tampered with: a sticker over a menu, a sign, or a parking meter; inspect it before your phone acts on it.
- People on a desktop or older laptop: no built-in camera scanner (see scanning on a laptop or desktop), but you can drop in a screenshot or photo and pull out the Wi-Fi password or link.
- People building QR codes: decode your own generated code to confirm the payload is formatted the way a scanner expects; the right
WIFI:field order, a validBEGIN:VCARDblock, the correct EPC line layout. - IT and helpdesk: check what a code a user received actually points to before advising them.
- Researchers and reviewers: read the exact bytes without a scanner app deciding what to do with them.
Decoding vs. scanning
| This decoder | Phone camera | |
|---|---|---|
| Input | An image file you upload | A live view of the code |
| What happens on decode | The raw text is printed; nothing runs | The OS may open a link, dial, or prompt to join a network |
| Good for | Inspecting an unknown or suspicious code | Codes you already trust |
| Sees the destination host before you commit | Yes | Only in a preview you might tap past |
Tips, limits, and common mistakes
- Give it a clear image. The code should fill a good part of the frame and be in focus. A tiny code in the corner of a wide photo often won't decode.
- Scheme matching is lowercase. The parser looks for
http://,smsto:,mailto:,geo:, andbitcoin:in lowercase. An unusual code with an uppercase scheme still decodes, it just shows as Raw Text rather than a typed table. - Upload a raster image, not an SVG. The decoder rasterizes the file to read it; PNG, JPG, and WebP are safe. An SVG without a fixed width and height may not draw.
- It reads the code; it doesn't vet the link. A decoded URL is not a verdict on safety. Use the Security Scanner button and your own judgment on the domain.
- Escaped Wi-Fi values aren't unescaped. The
WIFI:standard escapes semicolons and colons inside a name or password as\;and\:. The parser splits on the raw characters, so a network name containing one may show a truncated field; check the raw string in that case. - Masking is visual only. A revealed Wi-Fi password sits in the page like any other text. Close the tab when you're done on a shared computer.
- One code at a time. There's no batch mode; upload each image separately.
Photographing a code you don't trust
Open your normal camera app and take a photo from a slight angle, without holding steady long enough for the phone to read and act on the code. Then upload that photo here. Everything after that happens on your device, with nothing opened until you decide to.