Lukis' Space

← Tools

Code scanner

Read QR codes and barcodes with your camera or from an image. Every format ZXing knows.

Runs entirely in your browser. Nothing you enter here is sent to the server.

Camera is off

From a file

Drop an image here, paste one, or

The image is decoded in this page. It is not uploaded.

Result

Nothing scanned yet.

How this works, and why it is careful with what it finds

The decoder is zxing-cpp compiled to WebAssembly, served from this site. It loads once, about 1.5 MB, and then runs offline. Camera frames go to a canvas and straight into the decoder; no frame is uploaded, stored or kept after it has been looked at.

Supported: QR, Micro QR, rMQR, Aztec, Data Matrix, PDF417, MaxiCode, Codabar, Code 39/93/128, ITF, DataBar, EAN-8/13, UPC-A/E, DX film edge and Telepen.

The content is shown before anything else

A scanned code is untrusted input. Anyone can print one. So this page always shows you the decoded text first, as plain text, and never acts on it by itself:

  • The text is inserted as text, never as markup. A code containing HTML or a <script> tag shows those characters and nothing happens.
  • Nothing is ever opened automatically. The old version of this tool redirected you if the code looked like one of my own links. That was convenient and wrong.
  • An Open link button appears only for http and https URLs, after the browser's own URL parser has accepted it. javascript:, data: and friends never get a button.
  • The hostname is printed on its own next to the link, because that is the part that decides where you end up, and a long URL hides it well.
  • Invisible characters — zero-width spaces, right-to-left overrides, control codes — are counted and called out. They are how example.com is made to look like something it is not.
  • Links carry rel="noopener noreferrer nofollow", so the opened page cannot reach back into this one and gets no referrer.

A binary payload is shown as hex rather than mangled into text.

Camera access

The browser asks before the camera starts, the camera stops when you press Stop, when the page is hidden, and when you leave. A torch button appears only if the selected camera reports one. Camera access needs HTTPS (or localhost).

Other tools

  • Code generator — Make a QR code, Data Matrix, Aztec, PDF417 or a linear barcode and download it.
  • Link inspector — See where a link really goes before you open or shorten it: the real host, lookalike letters, hidden redirects and tracking parameters.
  • Base converter — Encode and decode between text and Base2 through Base85, or convert integers between any two bases.
  • Hash generator — MD5, SHA family, CRC32 and MySQL5 over text or a file. The file is read in your browser.
  • JWT decoder — Read a JSON Web Token's header and claims, with every timestamp as a date. Decoded right here; the token is never sent or stored.
  • SSH key fingerprint — SHA256 and MD5 fingerprints, key type and size, and SSHFP records for a public key. Private keys are refused unread.
  • Password generator — Random passwords from a CSPRNG, with the character classes you pick.
  • TOTP generator — Turn a TOTP secret or otpauth:// link into the current code. The secret stays on your device.
  • Timestamp converter — Unix time to a calendar date and back, in every format at once. Live clock included.
  • Subnet calculator — IPv4 and IPv6: network, range, host count, masks and reverse-DNS pointers.
  • Image resizer — Resize and convert an image without it ever leaving your browser. Re-encoding drops EXIF and GPS.
  • IP info — Your public IPv4 and IPv6, as this server sees them.
  • PHP obfuscator — Wrap PHP so it self-decodes at runtime. Runs on the server; the code is never stored.