QR Code Reader

The “Website link” sample is a 246 × 246 px PNG. The decoder finds the three finder squares and the code’s corners at (24, 24) and (222, 222), so the code is 198 px wide. It is version 4, which is 4 × 4 + 17 = 33 × 33 modules, so each module is 198 ÷ 33 = 6 px — easy to read. The 15 format bits read 100101010100000; XOR with the fixed mask 101010000010010 gives 00111…, so the level bits are 00 = M and the mask bits 111 = pattern 7, with no bit errors and both copies agreeing. The data is one byte-mode segment of 51 bytes: 4 + 8 + 51 × 8 = 420 bits out of the 64 × 8 = 512 data bits of version 4-M, 82.0% full. The text is https://utilitiesbunker.com/tools/qr-code-generator.

The “Damaged, low contrast” sample is grey on grey, turned 7°, with a 5 × 5-module logo in the middle and two scuffs. It still reads on the first pass: version 3 (29 × 29), level H, mask 4. Version 3-H has 70 codewords, only 26 of them data and 44 Reed–Solomon, which is why it survives losing about 30% of the code; the 24-byte link uses 204 of its 208 data bits (98.1%).

The common mistake: trusting what the link appears to say. The “Phishing-style link” sample (version 8, 49 × 49, level M) decodes to http://[email protected]/verify?account=suspended&…. Everything before the @ is a user name the browser ignores, so it does not open secure-login.example.com at all: it opens the bare IP address 203.0.113.45, over unencrypted http, on a page called “verify”. All four are flagged in Check before you open.

The other common mistake: a code too small to read. The “Too small and blurry” sample is a version 5 code (37 × 37 modules) squeezed into about 100 px, so each module is about 100 ÷ 41 ≈ 2.4 px (counting a 2-module border) and the edges are blurred. All six passes (as-is, contrast stretch, threshold, double size, smoothed, double size with contrast) and the tile search fail. At the rule of thumb of 3 px per module plus a 4-module quiet zone on each side, it needs at least (37 + 8) × 3 = 135 px across in the picture: move closer, or print it bigger.

A reader first finds the three large finder squares in the corners, which fixes the code’s position, angle and perspective. From their spacing it estimates the grid size, then samples the centre of every module as dark or light. The 15 format bits beside the finders give the error-correction level and which of the 8 mask patterns was applied; the reader flips the masked modules back, collects the codewords in their zig-zag order, repairs damaged ones with Reed–Solomon and finally reads the segments: a 4-bit mode (numeric, alphanumeric, byte, kanji or ECI), a character count and the data.

Sources: the error-correction levels are from Denso Wave’s Error correction feature page, the 21 × 21 to 177 × 177 range from its Information capacity and versions page, and the format-string mask and level bits from Thonky’s QR code tutorial; the data-codeword table is ISO/IEC 18004.

Denso Wave, then a division of the Japanese car-parts maker Denso, announced the QR code in 1994. Its development was led by Masahiro Hara, working with one colleague; users had asked for a code that held far more than the 20 or so characters of a barcode, including Kanji and Kana. After about a year and a half of trials the result could hold about 7,000 digits and be read more than ten times faster than other codes of the time, which is where “QR”, for quick response, comes from. The three corner marks are squares because, Hara said, that was “the pattern least likely to appear on various business forms”, so a reader would not mistake printed text for a code. The car industry adopted it first, for electronic Kanban tracking from production to shipping.

Denso Wave kept its patent but declared it would not exercise it, so anyone could make and read the codes for free. The code became an AIM standard in 1997, a Japanese Industrial Standard in 1999 and an ISO standard (ISO/IEC 18004) in 2000 (Denso Wave, History of QR Code). The same openness is why fake codes are easy to print: “quishing” stickers on parking meters and phishing emails with a QR image instead of a link both rely on people opening the code without seeing where it leads.

This reader decodes QR codes from images, pasted screenshots and the camera, then analyses what it found. It uses the browser’s built-in BarcodeDetector where one exists and the bundled open-source jsQR decoder everywhere else, and when a picture is hard it retries with contrast stretching, a black-and-white threshold, inversion for light-on-dark codes and different sizes. It also reads the code’s own format and version bits, so the error-correction level and mask shown are what is actually printed in the code, and it explains each segment’s bit cost.

The content is recognised and laid out: web links with their real host and safety checks, Wi-Fi logins (password hidden until you ask), vCard and MeCard contacts, email, phone, SMS, map locations, calendar events, two-factor setup codes and payment requests. Decoded text is treated as untrusted and shown as plain text, and links are never opened automatically. Everything runs in your browser; images and camera frames are not uploaded, and the camera is only switched on when you press the button.

Related tools: QR Code Generator, URL Encoder / Decoder, and TOTP Code Generator & Checker.