RedactMy.pics

Cover a QR Code in an Image

A QR code looks like decoration and behaves like a link. Redacting the text next to one while leaving the code visible is the most common way a careful redaction fails completely.

Open the redaction tool

Free, no account, and the image never leaves your browser.

A QR code is a URL that does not look like a URL

A QR code encodes up to a few thousand characters and in practice almost always encodes a URL, a payment request, a Wi-Fi credential, or a structured identifier like a ticket or a patient record. It scans instantly, it is not obviously data, and it survives in places people consider decorative — the corner of a receipt, a shipping label, a conference badge, a poster in the background of a photo.

The failure pattern is consistent: someone redacts the account number printed on a receipt and leaves the QR code that opens the same transaction. Or they cover the patient name in a screenshot and leave the specimen label. Or they blur a face in a photo and leave the event badge on the lanyard, which resolves to a named attendee record.

There is a second problem that is specific to machine-readable codes: a partial cover often does not work. QR codes carry error correction data, and at the common levels the format tolerates damage to a meaningful fraction of its modules. Covering the middle third of a code frequently leaves it readable. The finder patterns in three corners do most of the work of locating the symbol, and the rest can be reconstructed from the error correction data.

Where QR codes and barcodes turn up

The first two are the ones people expect. The rest are the ones that leak.

Receipts and invoices
Often the code resolves to the full digital transaction, including card digits and a customer identifier. It is a direct pointer, not just a summary.
Shipping labels and packing slips
Encodes the tracking number, which frequently resolves to a delivery address on the carrier's public tracking page.
Specimen labels and wristbands
Encodes the medical record number. Covering the printed text and leaving the barcode leaves the lookup key intact.
Event badges and lanyards
Common in conference photos, including background figures. Often resolves to a named attendee record.
Posters, menus, and signage
In the background of a photo taken in a public place. Rarely the subject, always scannable.
Payment requests
Person-to-person payment codes. Covering the visible account number does nothing about a code that opens a payment page directly.
Wi-Fi credentials
On a router label or a printed card in an office photo. A scanned code joins the network without a password being visible anywhere.
Ticket and boarding pass codes
Aztec and PDF417 codes on travel documents. They encode the booking reference and sometimes the passenger name.

Detection does not read codes at all

This is worth stating plainly because it is the most likely source of a false sense of safety on this page.

Found automatically

  • Email addresses printed near the code
  • Phone numbers printed near the code
  • Card numbers of 13 to 19 digits that pass the Luhn checksum, when printed in full
  • IPv4 addresses, occasionally in a footer

Needs a box by hand

  • The QR code itself. It is a graphic, not text, so the recognition pass never sees it.
  • Barcodes, including Code 128, EAN, and PDF417.
  • Aztec codes on travel documents.
  • The URL or identifier a code encodes.
  • Any text rendered inside the image area of a code, such as a payment logo.

Covering a code so it cannot be scanned

A code is not covered until it fails to scan. That is a testable condition, and it is worth testing rather than assuming.

  1. Locate every code, not just the obvious one

    Scan the whole frame at full zoom. Codes in a photo are often small, in a corner, or on an object in the background rather than the subject.

  2. Cover the whole symbol plus its margin

    Draw the box past the symbol on all four sides, including the blank quiet zone. Cropping into the quiet zone can leave a code readable by a determined scanner.

  3. Do not rely on covering the middle

    Error correction means a partially covered code is often still decodable. Cover the entire symbol rather than the data-bearing center.

  4. Use solid fill, never blur

    A blurred code retains the light-dark structure of its modules, and scanners are designed to work with degraded input. Solid black removes the pattern entirely.

  5. Handle codes on curved or angled surfaces carefully

    A code on a bottle, a lanyard, or a sign photographed at an angle needs a box that follows the shape. Several small overlapping boxes are safer than one loose box.

  6. Test the export

    After downloading, try to scan the exported PNG with a phone. If it scans, the box was not wide enough. This is the only reliable check.

Why error correction makes partial covers dangerous

QR codes are designed to be readable when damaged. That is a feature for a sticker on a shipping box and a hazard for anyone trying to redact one. The format stores redundant data at one of four error correction levels, and at the common medium level it tolerates roughly fifteen percent of the symbol being unreadable. At the highest level it tolerates about thirty percent.

This means the intuitive action — put a box over the middle of the code — is the least effective one. The middle carries data, but the redundancy means the data can often be reconstructed. What a scanner actually needs is the three large square finder patterns in the corners, which establish the symbol's position, scale, and orientation. Leave those visible and cover the middle, and many scanners will still succeed.

The robust approach is therefore to cover the symbol in its entirety, including the quiet zone of blank space around it, with a single solid box. There is no redundancy that survives the complete removal of every module.

Barcodes behave differently but the conclusion is the same. One-dimensional codes carry a check digit and a small amount of redundancy, and linear scanners are tolerant of partial height — a barcode with its top half covered often still reads. Cover the full height and the full width, plus the margins.

The honest limitation of this tool on this task is that it cannot tell you whether you succeeded. It does not read codes, so it cannot verify that a code is gone. A phone camera can, in about three seconds. That is the check to run.

A code is the one thing on a page that cannot be assessed by reading it, which makes it the easiest thing to forget. If you are working through a whole document rather than a single photo, you can redact image online using the same checklist that covers the codes along with everything printed beside them.

Frequently asked questions

Is blurring a QR code enough to stop it being scanned?
Frequently not. Scanners are built to tolerate degraded input, and a blur preserves the light-dark structure of the modules. Use a solid fill.
I covered the middle of the code. Is it safe?
Probably not. Error correction lets a code survive damage to a meaningful fraction of its modules. Cover the whole symbol including the blank margin around it.
Does the tool detect QR codes automatically?
No. A QR code is a graphic rather than text, so text recognition never sees it. Every code needs a box drawn by hand.
How can I be sure the code is really gone?
Try to scan the exported PNG with a phone. If a scanner resolves it, the box was not wide enough. That is the only check that reflects what an attacker would do.
What about barcodes on the same document?
Same treatment, but cover the full height as well as the full width. Linear scanners tolerate partial height, so a barcode with its top covered can still read.