Skip to content
QRCodeDojo
Tools

Passkey QR Code Reader

Turn a screenshot of a passkey “use your phone” QR Code into its FIDO:/ link, decoded on your device.

  • Free, no account
  • Nothing uploaded
  • Decoded on your device

PNG, JPG, WebP, GIF or SVG, up to 20 MB. Crop to the code if the screenshot shows other QR Codes too — the first one found is read.

Already have the text? Paste it instead

Passkey link

Nothing read yet. Choose a screenshot of the passkey QR Code your browser is showing, and its FIDO:/ link appears here.

What is inside a passkey QR Code

The code is not a web address. It is a FIDO:/ link followed by digits, and those digits are a small block of data packed into numbers so the QR Code can store it as compactly as possible. Unpacked, it contains:

  • A public key made for this one sign-in, so the phone and computer can set up an encrypted channel.
  • A one-time secret that proves the phone actually saw this code. This page never shows it.
  • What is being asked — use an existing passkey, or create a new one.
  • When the code was made, which is how this page can tell you it has probably expired.
  • Whether the computer offers to remember the phone, so next time it can ask the phone directly without a QR Code.
  • How many relay servers the browser knows. The two devices talk through one of these, and the content is encrypted end to end.

How to use the link

  1. Start the sign-in on the computer and pick the option to use a phone or tablet. A QR Code appears.
  2. Take a screenshot of it and drop it here — or paste the FIDO:/ text if you already have it.
  3. Copy the link and open it on the phone that holds the passkey, then approve with your fingerprint, face or PIN. Keep Bluetooth on: the phone uses it to confirm it is near the computer.

Note Never finish a sign-in you did not start

A passkey sign-in only completes when the phone is close to the computer that made the code, which stops most remote attacks. Even so: if a message, email or stranger asks you to scan a passkey code or open a FIDO:/ link, do not approve it. You would be signing someone else's computer in to your account.

For developers

The packing is the one Chromium uses for hybrid (formerly caBLE v2) transport: the data is split into 7-byte chunks, each read as a little-endian integer and written as 17 zero-padded decimal digits, with a shorter fixed-width group for the last partial chunk. The bytes are a CBOR map — key 0 the compressed P-256 public key, 1 the 16-byte secret, 2 the number of known tunnel-server domains, 3 the creation time in seconds, 4 the linking flag and 5 the request type (ga or mc). Unknown keys are listed rather than rejected, so a newer browser's codes still read.

Ask the sensei

Frequently asked questions

What is a passkey QR Code?
When you sign in on a computer and choose to use a passkey saved on your phone, the browser shows a QR Code. Scanning it starts a short, encrypted handshake between the phone and the computer. The code holds a link that begins with FIDO:/ followed by a long string of digits.
Why would I want the link instead of scanning the code?
Mostly when you cannot point a camera at it: the code is on the same phone you need to scan it with, it arrived as a screenshot, or you are building or testing a sign-in flow and want to see what the browser produced. With the link copied, you can open it directly on the phone that holds your passkey.
Is it safe to upload a passkey QR Code here?
Nothing is uploaded. The image is decoded in this tab and the result stays in this tab. The code's one-time secret is recognised but never displayed. On its own, the link cannot sign anyone in: the phone has to be physically close to the computer that showed the code, which it checks over Bluetooth, and you still approve with your fingerprint, face or PIN.
How long does a passkey QR Code last?
Only a few minutes, and only for one sign-in. Browsers replace the code if you wait, and it is useless once the sign-in finishes or is cancelled. The reader shows when the code was made and warns you when it is probably expired.
Opening the link on my phone does nothing. Why?
Some phones accept passkey codes only from the camera, not from a tapped link. If that happens, show the screenshot on another screen and scan it with the phone's camera app. Also check that Bluetooth is on — the phone needs it to confirm it is near the computer.
What do “sign in” and “create” mean in the result?
The code says what the computer is asking for. Sign in means it wants to use a passkey you already have. Create means a site is asking to save a new passkey on your phone. If you expected one and see the other, stop and check what you clicked.

Next stage

Related tools

QR Code Scanner Camera or image upload. Shows the real destination and flags risky links before you open them. URL QR Code A website, a menu, a booking page — encoded directly, with no redirect in between. Text QR Code Any string at all. Works offline once the code is printed. Print Size Checker Module size in mm, scan distance, export dpi and a verdict you can check.