Camera permissions and QR scanning

Rule one: no HTTPS, no camera

Browsers expose getUserMedia — the camera API behind every web-based scanner — only in a secure context: an https:// page, or http://localhost during development. On plain HTTP the API simply is not there, and no permission prompt will ever appear. If a scanner page shows no camera and no prompt at all, check the address bar scheme before anything else.

How the permission grant works

The first camera request on a site triggers a browser prompt, and the choice is remembered per origin — grant useqr.app the camera once and the scanner will not ask again, while every other site still starts from zero. Three properties worth knowing:

• The grant is to the site, not the page. Any page on the same origin inherits it.
• Denial is sticky. Dismissing the prompt may be temporary, but choosing "Block" is remembered, and the site cannot re-prompt — only you can undo it.
• The OS has a veto. On macOS and Windows, the browser itself needs camera access in the system privacy settings. A browser blocked at OS level shows a black feed or an immediate error even after you click Allow.

What "blocked" looks like

The symptom is always the same — the scanner's camera pane stays empty — and the cause is almost always a stored denial. Every major browser puts a camera indicator in or near the address bar: click it to see the current permission and flip it back to Allow, then reload the page. In Safari on iOS, camera choices live under the page settings (ᴀA) menu instead. Exact menus shift between versions, but "click the camera icon by the URL" recovers the large majority of cases.

Two rarer causes: another app is holding the camera exclusively (video-call software is the usual suspect), and embedded scanners inside an <iframe>, which additionally require the embedding page to say allow="camera" — a Permissions Policy detail that mostly bites developers building webcam scanning into their own pages.

Kiosks and managed devices

On corporate and school machines, camera policy may be decided for you: enterprise browser policies can force-block camera access, and kiosk deployments do the opposite, pre-granting the scanner origin so a check-in station never shows a prompt. If you are deploying a scanning kiosk — a mounted iPad, for instance — grant the permission once during setup and verify it survives a reboot before opening the doors.

Why a scan page must offer file upload

Design lesson, learned the hard way by everyone who builds a scanner: the camera path fails for reasons you cannot fix remotely — HTTP mirrors, stored denials, OS vetoes, borrowed machines, missing webcams. A file-upload fallback fails for none of them. Uploading a screenshot needs no permission at all, and on phones, <input type="file" capture> hands off to the native camera app, which sidesteps getUserMedia entirely. That is why our scanner treats upload and paste as first-class inputs rather than a footnote — and both keep the image on your device, the same client-side principle the generator follows.

FAQ

Why is a QR scanner website not accessing my camera?

Either the page is not HTTPS, the site's camera permission was previously blocked, or the operating system is denying the browser camera access. Click the camera icon near the address bar, set it to Allow, and reload.

How do I unblock the camera for a QR scanner?

Click the camera indicator in or near the address bar, change the setting to Allow, and reload the page. On iOS Safari, use the page settings menu. Check the OS privacy settings if the feed stays black.

Does uploading a QR code image need camera permission?

No. File uploads bypass the camera API completely, which is why they work when live scanning is blocked. On phones, a file input can hand off to the native camera app without any browser permission prompt.

Why does the scanner ask for permission again on another site?

Camera grants are stored per origin. Allowing one scanner site says nothing about any other site, so each new origin triggers its own prompt — a deliberate privacy property of the browser permission model.