Email QR Code
Decoder & Reader
Decode email QR codes (mailto: format) to instantly reveal the recipient address, pre-filled subject, and message body. Upload an image or scan with your camera — always private.
Upload Email QR code
Drop your QR image here or click to browse — Ctrl+V paste also works
Camera is off
Click Start Camera to begin scanning
Recent Scans
Understanding Email QR Codes
Email QR codes encode a mailto: URI — an internet standard defined in RFC 6068 that instructs devices to open an email composition window pre-populated with the encoded details. When scanned on a mobile device, it automatically opens the default mail app.
A full mailto: URI can look like:
mailto:[email protected]?subject=Enquiry&body=Hi%20there%2C%20I%20would%20like%20to...
Our decoder parses the address, subject, and body fields and displays them clearly — so you know exactly what email would be sent before acting on it.
Fields an Email QR Code Can Contain
- To: One or more recipient email addresses
- CC: Carbon copy recipients
- BCC: Blind carbon copy recipients
- Subject: Pre-filled email subject line
- Body: Pre-written message body text
Common Use Cases
- Business cards with a "contact us" email QR code
- Product packaging for customer support or warranty registration
- Conference and event feedback collection
- Marketing campaigns with pre-filled enquiry forms
- Restaurant menus with order-by-email links
Email QR Code Security Risks
While email QR codes are lower risk than URL-based QR codes (they don't navigate a browser), they carry their own specific attack vectors that users should understand before scanning unknown codes.
Social Engineering via Pre-filled Emails
A malicious email QR code can pre-populate a message body with text designed to impersonate the victim — for example, a pre-written authorization message or a request for sensitive account information. When the victim taps "Send" without reading the pre-filled content carefully, they unknowingly send the attacker's crafted message from their own email account.
Email Harvesting
Posting QR codes in public that encode a mailto: link to a legitimate-looking address is a way for spammers to collect active email addresses. When someone scans and sends even a blank message, the attacker confirms the sender's email is active and in use.
BCC Exfiltration
A mailto: URI can include a BCC field that silently copies a third party on any email sent. Victims scanning the QR code may send what they believe is a private communication while unknowingly copying an attacker's address. Our decoder reveals all BCC fields so you can spot this before acting.
Best Practices
- Always decode and review the full mailto: content before sending
- Check the BCC field carefully — it should be empty for most legitimate uses
- Read the pre-filled subject and body before tapping Send
- Be suspicious of email QR codes in unsolicited physical mail
Email QR Decoder FAQ
mailto: followed by the email address and optional query parameters for subject, body, cc, and bcc. Our decoder parses these and displays each field with a clear label.