# Camera permissions and QR scanning

> Browsers only expose the camera on HTTPS pages, and each site needs a one-time permission grant — look for the camera icon in the address bar if scanning fails. A blocked camera is the most common reason web scanners fail, which is why good ones also accept image uploads.

Source: https://useqr.app/docs/scanning/camera-permissions-and-qr-scanning · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Rule one: no HTTPS, no camera

Browsers expose `getUserMedia` — the camera API behind every
[web-based scanner](/docs/scanning/qr-scanning-in-a-browser) — only in a **secure
context**: an `https://` page, or `http://localhost` during development. On plain HTTP
the API simply is not there, and no permission prompt will ever appear. If a scanner
page shows no camera and no prompt at all, check the address bar scheme before anything
else.

## How the permission grant works

The first camera request on a site triggers a browser prompt, and the choice is
remembered **per origin** — grant `useqr.app` the camera once and the
[scanner](/scan) will not ask again, while every other site still starts from zero.
Three properties worth knowing:

- **The grant is to the site, not the page.** Any page on the same origin inherits it.
- **Denial is sticky.** Dismissing the prompt may be temporary, but choosing "Block" is
  remembered, and the site cannot re-prompt — only you can undo it.
- **The OS has a veto.** On macOS and Windows, the browser itself needs camera access in
  the system privacy settings. A browser blocked at OS level shows a black feed or an
  immediate error even after you click Allow.

## What "blocked" looks like

The symptom is always the same — the scanner's camera pane stays empty — and the cause
is almost always a stored denial. Every major browser puts a **camera indicator in or
near the address bar**: click it to see the current permission and flip it back to
Allow, then reload the page. In Safari on iOS, camera choices live under the page
settings (ᴀA) menu instead. Exact menus shift between versions, but "click the camera
icon by the URL" recovers the large majority of cases.

Two rarer causes: another app is holding the camera exclusively (video-call software is
the usual suspect), and embedded scanners inside an `<iframe>`, which additionally
require the embedding page to say `allow="camera"` — a Permissions Policy detail that
mostly bites developers building
[webcam scanning into their own pages](/docs/developers/read-qr-codes-from-a-webcam-in-the-browser).

## Kiosks and managed devices

On corporate and school machines, camera policy may be decided for you: enterprise
browser policies can force-block camera access, and kiosk deployments do the opposite,
pre-granting the scanner origin so a check-in station never shows a prompt. If you are
deploying a scanning kiosk — a
[mounted iPad](/docs/scanning/qr-scanning-on-ipad), for instance — grant the permission
once during setup and verify it survives a reboot before opening the doors.

## Why a scan page must offer file upload

Design lesson, learned the hard way by everyone who builds a scanner: **the camera path
fails for reasons you cannot fix remotely** — HTTP mirrors, stored denials, OS vetoes,
borrowed machines, missing webcams. A file-upload fallback fails for none of them.
Uploading a screenshot needs no permission at all, and on phones,
`<input type="file" capture>` hands off to the native camera app, which sidesteps
`getUserMedia` entirely. That is why our [scanner](/scan) treats upload and paste as
first-class inputs rather than a footnote — and both keep the image on your device, the
same [client-side principle](/docs/security/client-side-vs-server-side-qr-generation)
the generator follows.

## FAQ

### Why is a QR scanner website not accessing my camera?
Either the page is not HTTPS, the site's camera permission was previously blocked, or
the operating system is denying the browser camera access. Click the camera icon near
the address bar, set it to Allow, and reload.

### How do I unblock the camera for a QR scanner?
Click the camera indicator in or near the address bar, change the setting to Allow, and
reload the page. On iOS Safari, use the page settings menu. Check the OS privacy
settings if the feed stays black.

### Does uploading a QR code image need camera permission?
No. File uploads bypass the camera API completely, which is why they work when live
scanning is blocked. On phones, a file input can hand off to the native camera app
without any browser permission prompt.

### Why does the scanner ask for permission again on another site?
Camera grants are stored per origin. Allowing one scanner site says nothing about any
other site, so each new origin triggers its own prompt — a deliberate privacy property
of the browser permission model.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate