QRLume
Read it, don’t run it.
Forensic QR code scanner for investigators. QRLume reads each code as data, opens nothing on its own and sends nothing to ProfWorkBench. For iPhone, iPad and Mac.
Each code is examined as data inside the App Sandbox. Nothing opens, dials or downloads on its own: a link, number or contact goes to your browser or another app only after you confirm.
Local checks for a dangerous URL scheme, an executable hook, null bytes, bare IPv4 routing, terminal escapes and overflow padding give one verdict: High Risk, Caution or No Local Red Flags. No threat database is consulted, and No Local Red Flags never means a code is safe. Requires Forensic Pro.
The report shows the raw payload bytes as a hexadecimal dump beside the decoded payload, and a Shannon entropy score from 0 to 8 labelled Low, Medium or High. The score describes the payload and never changes the verdict. Requires Forensic Pro.
For QR codes, QRLume reads the payload bytes from the symbol itself rather than from a decoded string, so the checks see what a text decode loses, such as a null byte and everything after it. When QRLume can't read a symbol's own bytes, as with Aztec and PDF417, the report says so.
Every scan is logged with a SHA-256 digest of its image, and an imported image file is hashed byte for byte. A PDF exhibit names the examiner set in QRLume's Settings and adds a provenance block: record ID, times, engine version, what the hash covers, and whether the stored image still matches its digest. Requires Forensic Pro.
QR, Aztec and PDF417 codes, one code per image, from the camera, Photos or an image file; what the live camera detects depends on the device. It does not read 1-D barcodes such as UPC, EAN or Code 128. A photo is picked in Apple’s photo picker, so QRLume never sees the rest of your library.
Zero Telemetry: QRLume sends no analytics, crash logs or usage data to ProfWorkBench, and ProfWorkBench never receives your scans. Scanning and analysis run on your device. The only network traffic QRLume initiates goes to Apple. StoreKit checks for a Forensic Pro purchase each time QRLume starts and handles buying and restoring it; that traffic carries no scan data. iCloud Sync, only while it is on, copies your evidence records, scanned payloads and images included, to the private CloudKit database in your own iCloud account, encrypted in transit and at rest. End-to-end encryption requires Advanced Data Protection on your Apple Account; without it, Apple holds the keys. On a new install, iCloud Sync stays off until you turn it on; people updating from version 1.0 may have it on. Nothing you scan opens on its own: a link, number or contact goes to your browser or another app only after you confirm.
The report (verdict, decoded payload and analysis) requires Forensic Pro. One purchase covers iPhone, iPad and Mac, and the annual plan renews automatically unless you turn it off at least 24 hours before the period ends. Prices are US prices.
QRLume needs iOS or iPadOS 26 or later, or macOS 26 or later on a Mac with Apple silicon.
Educational, military, and first-responder discounts apply; see Academic & Service Discounts.