QRLume: Forensic QR Scanner

Point a normal camera at a QR code and it acts on whatever is inside — a spoofed login page, a silent download, a premium-rate dialer — before you can read a single character of it.

QRLume reads it safely instead of running it. It decodes the code on iPhone and iPad, examines it, and turns the result into a PDF exhibit recording what it found and what it could not see.

IN THE FIELD
The live camera detects the code, with a 1x-5x zoom for a sticker across the room and a front/back switch. A screenshot comes in from Photos, an image file through the picker.

WHAT IT READS
QR, Micro QR, Data Matrix, Aztec and PDF417 — no UPC, EAN, Code 128 or other 1D barcodes. Live detection is limited to what the device reports it supports; an imported image is not.

READ, NEVER RUN
A payload is data here, not an instruction. Nothing is opened, dialed, messaged or fetched while it is examined — every check is static, on the device, inside the app sandbox. Photos come through the system picker, which hands over only what you pick; a file only where you point the importer. Acting on one is a separate, deliberate step: a dialog naming the destination in full, warning again if it flagged a dangerous scheme, executable hook or null bytes.

SIX LOCAL CHECKS, AND WHAT THEY MISS
Every payload is tested for a dangerous URI scheme, an executable or shell hook, null bytes, bare-IPv4 routing, terminal escapes and overflow padding — all on device. Three read the payload's text form; where that form is not all of the payload, or the symbol's bytes were never obtained, QRLume says so, raises the verdict to caution and prints the limit onto the exhibit. A payload passes all six only when all six saw it whole.

THE SYMBOL'S OWN BYTES
For QR codes, QRLume parses the payload out of the symbol's error-corrected codeword stream (ISO/IEC 18004) rather than off a decoded string, recovering bytes a text decode drops. The other four fall back to the decoded text, as does any QR stream it cannot parse, and every record says which of the two it holds.

THE EXHIBIT
Export a PDF carrying the decoded payload, the six results and a SHA-256 digest naming what it covers — the stored capture image or the imported file's bytes, never the payload or the PDF. A provenance block prints record ID, times, engine version, examiner, how the bytes were obtained, and whether the stored image still matches its digest. The exhibit and the stored evidence image leave by share sheet or Files. Imported files keep their original bytes; camera captures store at up to 800 px.

EVIDENCE LOG AND SYNC
At setup you choose whether records stay on this device or replicate through your Apple Account's private database. End-to-end encryption requires Advanced Data Protection; without it Apple holds the keys. QRLume cannot detect whether it is on.

ZERO TELEMETRY
No analytics, no crash reporting, no ProfWorkBench servers. The only connections QRLume makes are Apple's: the App Store and iCloud while sync is on.

ACCESSIBILITY
Reduce Motion is an in-app setting as well as a system preference: ambient backdrops stop drifting and stay on screen. Verdict severity is spoken, not left to color. The hex dump reads line by line, each check row as one sentence, and the danger verdict's color meets AA contrast.

FORENSIC PRO
Forensic Pro unlocks the report — verdict, decoded payload, media details, entropy, hex dump, the six check rows, the SHA-256 anchor — plus the evidence log, PDF export and acting on a payload. Every scan is written to the evidence log, unlocked or not. Sold as an annual auto-renewing subscription or a one-time lifetime purchase; either covers iPhone, iPad and Mac. The annual plan renews unless turned off at least 24 hours before the period ends; manage it in Apple Account settings. Terms: https://profworkbench.com/#terms Privacy: https://profworkbench.com/#privacy

ALSO ON MAC
QRLume for Mac adds USB cameras, a camera-source picker and manual capture.

QRLume is made by ProfWorkBench, LLC.