FREE TOOL · GUIDE
What is inside this QR code?
A QR code is text drawn as squares. Anyone who photographs it has the text. Drop a picture of a code to see what it would give away. It is read in this browser tab: nothing is uploaded, and once the page has loaded it works with the network switched off.
Written by Taha Bayar, a biologist working on laboratory data handover.
What the tool looks for
| In the code | What a photo of it gives away |
|---|---|
| Wi-Fi sharing code | The network name and its password, in plain text |
| Authenticator set-up code | The secret that generates your one-time login codes, for good |
| Authenticator export | The secrets of every account in the export |
| Link with a password or token | Whatever that token opens: a camera view, a shared folder, a session |
| Private key or recovery phrase | Everything the key protects |
| A string nobody can read | Unknown. It may be encrypted, or only scrambled |
Scrambled is not encrypted
Many apps put a device ID, a user name and a password into a sharing code and scramble them so the code does not look like a password. The method and its key are inside the app, the same on every phone. Whoever takes the app apart once can read every code it ever made. Encryption is different in one respect only: the key is not in the app and not in the code.
In October 2026 a widely shared post showed an AI model working out the scrambling in a camera app's sharing code and reading the camera's user name and password from it. We have not verified that case. The weakness it describes is old and real, and what is new is the effort: work that took a specialist days now takes a chat window minutes. Scrambling that relied on nobody bothering no longer protects anything.
This tool does not try to undo any scrambling, and it cannot tell scrambled from encrypted by looking; nobody can from the outside. It tells you which of the two it would need to be for the code to be safe to show.
What to do with a code that carries a secret
- Do not post or send screenshots of it. Chat backups, photo clouds and support tickets keep them for years.
- Camera or recorder sharing codes: change the device password after sharing, give other people their own limited account, and switch off cloud access you do not use.
- Wi-Fi: show the code for a guest network, not the main one.
- Authenticator codes: if a set-up code was exposed, set up two-factor again so the old secret stops working. For a backup that is meant to last, see encrypted paper backup.
Questions people ask
Is a QR code encrypted?
No. A QR code is a way of drawing text, and any phone reads it. If the text was encrypted before it was drawn, the code carries encrypted text; you cannot tell that by looking at the squares.
Can someone get my Wi-Fi password from a photo of the QR code?
Yes. A Wi-Fi sharing code contains the network name and the password in plain text. Show the code of a guest network, not of your main one.
Is it safe to send a screenshot of a two-factor (2FA) set-up QR code?
No. It contains the secret that generates every future login code, so anyone with the screenshot can generate them too. If one was exposed, set up two-factor again so the old secret stops working.
Can a camera's sharing QR code reveal its password?
It can, if the app puts the password into the code and only scrambles it. This tool shows whether a code carries readable text or an unreadable string; for the unreadable kind, only the maker can say whether it is encrypted.
Does this tool upload my QR code?
No. The picture is read in your browser tab and nothing is sent anywhere. Once the page has loaded, it works with the network switched off.
How a code can be shown safely
A code is safe to show when it contains nothing secret. Kionel's pairing code carries only public keys; the two devices then agree on a key that never appears on any screen, and both show a short comparison code so that a swapped code is noticed. The file itself is encrypted with that key before the first image is drawn. A recording of the screen is then useless without the receiving device. How it works, and what it does not protect against.