Free QR Code Payload Decoder
A QR code holds text, and a handful of prefixes turn that text into a Wi-Fi login, a contact card or a calendar event. Paste what your scanner showed you: this names the format, breaks out every field, and flags the escaping mistakes that make a code fail silently.
Have the QR code as an image?
Choose a screenshot or photo, drop it here, or paste it with Ctrl+V / ⌘V. It is read on your device and never uploaded.
Parsed in this browser. Nothing is uploaded, requested, logged or stored.
Private by design: every payload here is parsed in your browser. Nothing is uploaded, logged or requested — load the page, turn off your connection, and it still works. That matters more for this tool than most: these payloads routinely carry Wi-Fi passwords, home addresses and authentication secrets.
A QR Code Only Holds Text
There is no "Wi-Fi QR code" in the QR specification. ISO/IEC 18004 defines how to store a string of
characters in a grid of black and white squares and stops there. Everything above that — joining a
network, saving a contact, opening a map — is a convention: scanners agree that a string beginning
WIFI: is network credentials and that one beginning geo: is a coordinate.
That is why a payload can be perfectly encoded, decode perfectly, and still do nothing. The squares are fine; the text inside them does not match a pattern the scanner recognises. This tool works on that text.
The five characters that have to be escaped
The WIFI: and MECARD: formats are field lists separated by semicolons, so a value
containing a delimiter has to say so with a backslash. Five characters are reserved:
| Character | Name | Why it is reserved |
|---|---|---|
\ | Backslash | It is the escape character itself, so a literal one has to be doubled. |
; | Semicolon | Ends a field. Unescaped, it cuts the value short and strands everything after it. |
, | Comma | Separates repeated values in MeCard, where it also divides surname from forename. |
: | Colon | Divides a field name from its value. Tolerated inside values by most parsers, but outside the format. |
" | Double quote | Wraps a value that could otherwise be read as hexadecimal, so a literal quote must be escaped. |
Escape the backslash first. If an encoder replaces semicolons before backslashes, the backslashes it just added get escaped a second time and arrive in the password as literal text. One pass over the string with a single character class avoids it; two sequential passes in the wrong order do not.
What this tool checks
- Which format it is, including the ones a scanner will silently treat as plain text.
- Every field, decoded — escapes resolved, quotes unwrapped, percent-encoding expanded.
- Unescaped delimiters, which show up as a value cut short and a stray fragment after it.
- Over-escaping — backslashes in front of characters that are not reserved.
- Hex-ambiguous values such as
CafeorBeef, which the format says to wrap in quotes. - Missing terminators, stray whitespace, byte-order marks and lower-case prefixes.
- Format-specific rules: Base32 secrets, latitude and longitude ranges,
DTSTART, vCardVERSION.
What it is not: a decoder for the image. It works on text a scanner has already read, not on a photograph of a code. It also cannot tell you whether a web address is safe — that is a different question, and the link checker answers it.
Format reference
| Starts with | What it does | Notes |
|---|---|---|
https:// or http:// | Web address | By far the most common. Check the domain, not the syntax. |
WIFI: | Wi-Fi credentials | Escaped field list. T, S, P, H. |
MECARD: | Contact card, compact | Escaped field list. Roughly half the size of a vCard. |
BEGIN:VCARD | Contact card, full | RFC 6350. Line-based, needs VERSION and END:VCARD. |
BEGIN:VEVENT | Calendar event | iCalendar. Needs DTSTART. |
otpauth:// | Two-factor secret | Base32 seed in a query string. Treat as a credential. |
mailto: | RFC 6068. Query string carries subject and body, percent-encoded. | |
MATMSG: | Email, legacy | NTT DoCoMo. Superseded by mailto: in practice. |
SMSTO: | Text message | SMSTO:number:message. Broader scanner support than sms:. |
sms: | Text message | RFC 5724. Message is percent-encoded, not raw. |
tel: | Phone number | RFC 3966. Use the full +country form. |
geo: | Map location | RFC 5870. geo:lat,lon with optional altitude. |
BCD | SEPA bank transfer | EPC QR. Positional, one field per line. |
Related Tools & Guides
Frequently Asked Questions
What data can a QR code actually hold?
Only text. Everything else is convention: a QR code stores a string, and scanners agree to treat certain prefixes specially. "WIFI:" means network credentials, "MECARD:" and "BEGIN:VCARD" mean a contact, "geo:" means a map pin, "otpauth://" means a two-factor secret. A scanner that does not recognise a prefix shows the raw text instead, which is why a mistyped prefix produces a code that appears to work but does nothing.
Why does my Wi-Fi QR code fail when the password has a semicolon?
Because the semicolon is the field separator. In a WIFI: payload the parser reads the password until it meets a semicolon, so an unescaped one inside the password ends the field early and the rest is discarded. The five characters that must be escaped with a backslash are the backslash itself, semicolon, comma, colon and double quote. A password of "pa;ss" has to be written "pa\;ss" or the phone tries to join with "pa".
Which characters need escaping in a Wi-Fi or MeCard QR code?
Backslash, semicolon, comma, colon and double quote, each preceded by a backslash. The order matters when you write the encoder: escape the backslash first, then the rest, or the backslashes you add for the other characters get escaped a second time and end up in the password as literal text. A single pass over the string with one character class avoids the problem entirely.
Why should an SSID like "Cafe" be in quotes?
Because every character in it is a hexadecimal digit. The Wi-Fi format says a value that could be read as hex should be wrapped in double quotes so the parser knows it is text, and words such as Cafe, Face, Beef, Decade and Added all qualify. Without the quotes a strict parser is entitled to interpret the name as a hex-encoded byte string and join the wrong network, or none.
Is it safe to paste a 2FA QR code here?
The page never sends it anywhere — there is no network request, no logging and no storage, and you can confirm that by loading the page and switching off your connection. That said, a two-factor seed is a long-lived credential rather than a password you can rotate, so the safest habit is to treat it like a spare key and not paste it into any website at all. The tool flags it as sensitive for that reason.
What is the difference between MeCard and vCard in a QR code?
MeCard is a compact format from NTT DoCoMo written as one line of semicolon-separated fields; vCard is the full RFC 6350 standard written as multiple lines. Both add a contact, but vCard costs considerably more characters for the same name, phone and email, which pushes the QR code to a higher version with smaller modules. For a simple contact on a printed card, MeCard usually scans more reliably at the same physical size.
Why does my QR code work on Android but not iPhone?
Most often a detail the two platforms disagree about rather than a broken code. Lower-case prefixes, a missing closing ";;", a trailing newline left by a text editor, and WPA3 written as "SAE" are all handled differently by different parsers. This tool flags each of them, because a payload can be accepted by one phone and silently ignored by another without either showing an error.
Does this tool upload the payload anywhere?
No. All parsing happens in your browser in JavaScript on this page. Nothing is uploaded, requested, logged or stored, which matters because these payloads routinely contain Wi-Fi passwords, personal contact details and authentication secrets.
See the Payload Before Your Phone Acts on It
Scan & Generate shows the decoded text of a code before it joins a network or opens anything, so you can copy it here and find out what it really says.