Supported Features
-
VoiceOver
-
Dark Interface
QRLume: Forensic QR Scanner
2D Barcode Evidence Examiner
Free · In‑App Purchases
Nothing is opened, dialed or fetched. QRLume examines the code as data inside the app sandbox and writes an exhibit stating what it measured and what it could not.
Point a normal camera at a QR code and it acts on whatever is inside — a spoofed login page, a silent download, a premium-rate dialer — before you can read a single character of it.
QRLume reads it safely instead of running it. It decodes the code on iPhone and iPad, examines it, and turns the result into a PDF exhibit recording what it found and what it could not see.
IN THE FIELD
The live camera detects the code, with a 1x-5x zoom for a sticker across the room and a front/back switch. A screenshot comes in from Photos, an image file through the picker.
WHAT IT READS
QR, Micro QR, Data Matrix, Aztec and PDF417 — no UPC, EAN, Code 128 or other 1D barcodes. Live detection is limited to what the device reports it supports; an imported image is not.
READ, NEVER RUN
A payload is data here, not an instruction. Nothing is opened, dialed, messaged or fetched while it is examined — every check is static, on the device, inside the app sandbox. Photos come through the system picker, which hands over only what you pick; a file only where you point the importer. Acting on one is a separate, deliberate step: a dialog naming the destination in full, warning again if it flagged a dangerous scheme, executable hook or null bytes.
SIX LOCAL CHECKS, AND WHAT THEY MISS
Every payload is tested for a dangerous URI scheme, an executable or shell hook, null bytes, bare-IPv4 routing, terminal escapes and overflow padding — all on device. Three read the payload's text form; where that form is not all of the payload, or the symbol's bytes were never obtained, QRLume says so, raises the verdict to caution and prints the limit onto the exhibit. A payload passes all six only when all six saw it whole.
THE SYMBOL'S OWN BYTES
For QR codes, QRLume parses the payload out of the symbol's error-corrected codeword stream (ISO/IEC 18004) rather than off a decoded string, recovering bytes a text decode drops. The other four fall back to the decoded text, as does any QR stream it cannot parse, and every record says which of the two it holds.
THE EXHIBIT
Export a PDF carrying the decoded payload, the six results and a SHA-256 digest naming what it covers — the stored capture image or the imported file's bytes, never the payload or the PDF. A provenance block prints record ID, times, engine version, examiner, how the bytes were obtained, and whether the stored image still matches its digest. The exhibit and the stored evidence image leave by share sheet or Files. Imported files keep their original bytes; camera captures store at up to 800 px.
EVIDENCE LOG AND SYNC
At setup you choose whether records stay on this device or replicate through your Apple Account's private database. End-to-end encryption requires Advanced Data Protection; without it Apple holds the keys. QRLume cannot detect whether it is on.
ZERO TELEMETRY
No analytics, no crash reporting, no ProfWorkBench servers. The only connections QRLume makes are Apple's: the App Store and iCloud while sync is on.
ACCESSIBILITY
Reduce Motion is an in-app setting as well as a system preference: ambient backdrops stop drifting and stay on screen. Verdict severity is spoken, not left to color. The hex dump reads line by line, each check row as one sentence, and the danger verdict's color meets AA contrast.
FORENSIC PRO
Forensic Pro unlocks the report — verdict, decoded payload, media details, entropy, hex dump, the six check rows, the SHA-256 anchor — plus the evidence log, PDF export and acting on a payload. Every scan is written to the evidence log, unlocked or not. Sold as an annual auto-renewing subscription or a one-time lifetime purchase; either covers iPhone, iPad and Mac. The annual plan renews unless turned off at least 24 hours before the period ends; manage it in Apple Account settings. Terms: https://profworkbench.com/#terms Privacy: https://profworkbench.com/#privacy
ALSO ON MAC
QRLume for Mac adds USB cameras, a camera-source picker and manual capture.
QRLume is made by ProfWorkBench, LLC.
The first update since 1.0, and a substantial one.
• Analysis runs on the symbol's own bytes, so the hex dump, entropy and checks describe what was really encoded.
• Verdicts now state their scope — what each check examined, and what it could not.
• Exhibits carry a full provenance block, and imported files are hashed.
• Reduce Motion is now an in-app setting; VoiceOver and text contrast reworked throughout.
• The report now requires Forensic Pro. Scanning is unchanged and still logged; 1.0 consumer unlock buyers keep full access.
The developer, ProfWorkBench, LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .
Data Not Collected
The developer does not collect any data from this app.
The developer indicated that this app supports the following accessibility features. Learn More
Information
- Seller
- ProfWorkBench, LLC
- Size
- 7.2 MB
- Category
- Utilities
- Compatibility
Requires iOS 26.0 or later.
- iPhone
Requires iOS 26.0 or later. - iPad
Requires iPadOS 26.0 or later. - Mac
Requires macOS 26.0 or later and a Mac with Apple M1 chip or later.
- iPhone
- Languages
English and 14 more
- English, Arabic, French, German, Hebrew, Hindi, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese, Spanish, Traditional Chinese, Turkish
- Age Rating
4+
- 4+
- In-App Purchases
Yes
- Forensic Pro Lifetime $99.99
- Forensic Pro Annual $39.99
- Copyright
- © 2026 ProfWorkBench LLC