ZERO TELEMETRY • ALL SCANS PROCESSED ON-DEVICE
QRLume is a forensic QR scanner built for investigators and evidence work. It reads a suspect code safely, as data, inside the App Sandbox — nothing in it opens unless you choose to. Forensic Pro takes the payload apart: hex dump, entropy, six checks, one verdict.
iOS & iPadOS 26+ · macOS 26+ ON APPLE SILICON
EXHIBIT A — THE CORE GRID
Every payload is decoded and analyzed on your device, and the analysis sends nothing anywhere. QRLume connects only to Apple: to StoreKit, which carries no scan data, and to your own iCloud account while iCloud Sync is on. Sync copies your evidence log there, payloads included.
Measures the structural randomness of every payload buffer on a 0–8 Shannon scale and labels it Low, Medium or High; high values are consistent with compressed or encrypted data. The figure is descriptive and never changes the verdict.
FORENSIC PROEvery scan is logged with its image and a SHA-256 digest of that image. An image file you open is hashed byte for byte, exactly as it was read. Export the record as a PDF exhibit that names the examiner and carries a provenance block: record ID, times, engine version, what the hash covers, and whether the stored image still matches it.
FORENSIC PROEXHIBIT B — DEEP DIVE
Six checks run against every payload, entirely on your device: dangerous URL schemes and IPC, executable shell and script hooks, naked IPv4 routing, embedded null bytes, terminal escape sequences, and buffer-overflow padding. The report opens with one verdict — High Risk, Caution or No Local Red Flags — shows which checks flagged the payload, and says so when they could not examine all of it.
FORENSIC PRORead the raw payload bytes as a hexadecimal dump alongside the decoded payload, to inspect malicious content without executing it. Copy the payload or the dump straight into your notes.
FORENSIC PROTurn on iCloud Sync and your evidence log is copied to your own iCloud account, encrypted in transit and at rest. End-to-end encryption requires Advanced Data Protection; without it, Apple holds the keys.
iCloudPick a photo in Apple’s photo picker, and QRLume reads the code in it. The picker runs outside QRLume, so QRLume never sees the rest of your library. The analysis runs entirely on your device.
SANDBOXEDFor QR codes, QRLume reads the payload bytes straight from the symbol, not from a decoded string. So the hex dump and the byte-level checks see what a text decode loses: a null byte and everything after it, or a payload that isn’t text at all. When QRLume can’t read a symbol’s own bytes, as with Aztec and PDF417, the report says so.
FORENSIC PROBuilt-in searchable documentation with step-by-step workflows, technical anchors and highlighted notes.
BUILT-INCASE FILE — HOW THE TRICK WORKS
In January 2022 the FBI warned that criminals were tampering with QR codes to redirect victims to malicious sites, steal credentials and funds, and deliver malware.
A malicious code pasted over the real one on a parking meter: the sticker trick the FBI warned about in 2022.
VECTOR 01Table-tent codes are just as easy to cover. You expect a menu; the page you land on asks you to sign in, and keeps what you type.
VECTOR 02Forensic Pro lays the payload out as data inside the App Sandbox — decoded, hex-dumped and checked six ways — and nothing in it runs unless you choose to.
COUNTERMEASURESIDE BY SIDE — YOUR CAMERA vs QRLUME
Scanning isn’t the risk — opening is. Your camera app is built to open what it finds. QRLume with Forensic Pro is built to show you first.
| Your camera app | QRLume | |
|---|---|---|
| The link opens | As soon as you tap the banner | Never on its own — opening it is a separate, deliberate step behind a warning |
| Entropy analysis | Not offered | Shannon entropy score on every payload (Forensic Pro) |
| Hostile-pattern check | Not offered | Six local checks for hostile patterns (Forensic Pro) |
| Record of the scan | Not offered | SHA256-anchored evidence log (Forensic Pro) |
EXHIBIT C — INTERFACE EVIDENCE
DISCLOSURE — WHAT THE APP CONNECTS TO
Zero Telemetry means QRLume sends nothing to ProfWorkBench: no scans, no usage data, no crash logs. The only network traffic QRLume initiates is Apple’s StoreKit connection to the App Store, plus your own iCloud sync when iCloud Sync is on. Nothing you scan opens on its own: a link, number, or contact goes to your browser or another app only after you confirm.
Copies your evidence records in full, payloads and images included, to the private CloudKit database in your own iCloud account, encrypted in transit and at rest. End-to-end encryption requires Advanced Data Protection on your Apple Account. ProfWorkBench never receives your records. On a new install, sync stays off until you turn it on, in Guided Setup or later in QRLume’s Settings › Security & Sync. A change made there takes effect after you quit and reopen QRLume.
Apple’s StoreKit checks for a Forensic Pro purchase each time QRLume starts, and handles buying and restoring it. That traffic goes to Apple, not to ProfWorkBench, and carries no scan data: StoreKit never receives a scanned payload, link, or hash.
DEPLOYMENT OPTIONS
The report — verdict, decoded payload and analysis — requires Forensic Pro.
Forensic Pro Annual
$39.99 / year
Forensic Pro Lifetime
$99.99 one-time
The features listed need iOS or iPadOS 26 or later, or macOS 26 or later on a Mac with Apple silicon.
Prices shown are in US dollars. The App Store charges the price for your country or region.
Auto-renewable subscriptions: payment is charged to your Apple account at confirmation of purchase. Subscriptions renew automatically unless auto-renew is turned off at least 24 hours before the end of the current period. Manage or cancel anytime in your App Store account settings.
Already own the Basic Consumer Unlock? On iOS or iPadOS 26 or later, and on a Mac with Apple silicon running macOS 26 or later, it unlocks everything in Forensic Pro. If the report stays locked, use Restore Purchases.
EXHIBIT D — PLAIN ANSWERS
The danger is rarely the scan itself — it is the link or data hidden inside the code. With Forensic Pro, QRLume shows you what a code contains without opening it, so nothing hostile gets the chance to run.
Scan it with QRLume instead of your camera app. With Forensic Pro you see the decoded address, a verdict from six local checks and an entropy score before you decide to visit anything, and the link never opens on its own. A verdict of No Local Red Flags means none of the six checks flagged it — not that the link is safe.
Quishing is phishing through QR codes: attackers paste malicious codes over real ones on parking meters, menus and posters. With Forensic Pro, QRLume shows the address exactly as the code encodes it and runs six local checks for hostile patterns; nothing opens unless you confirm. It does not expand shortened links or detect look-alike domains, and a look-alike address can read exactly like the real one — so treat any unexpected code as hostile.
Yes. Scanning and analysis run entirely on your device and need no connection. With iCloud Sync off, QRLume uploads nothing you scan. While iCloud Sync is on, your evidence records, scanned payloads and images included, are copied to your own iCloud account. The only other connection QRLume makes is Apple’s StoreKit, which checks for a Forensic Pro purchase and carries no scan data.
Yes. Photo Forensics reads the code in a photo you choose. File Inspector reads one from an image file, such as a screenshot saved on your Mac. You pick the photo in Apple’s photo picker, which runs outside QRLume, so QRLume never sees the rest of your library. The analysis runs entirely on your device. The scan is kept in your evidence log, which you open with Forensic Pro and which stays on the device while iCloud Sync is off.
The report requires Forensic Pro, sold two ways: Forensic Pro Annual at $39.99 a year, or Forensic Pro Lifetime at $99.99, paid once. Either one unlocks the verdict, the decoded payload, the hex dump, entropy, the six local checks and the SHA-256 anchor, plus the evidence log and PDF exhibits. Prices are in US dollars; the App Store charges the price for your country or region.
An iPhone or iPad with iOS or iPadOS 26 or later, or a Mac with Apple silicon and macOS 26 or later. A camera is needed only for live scanning. A device that already has QRLume but can’t run these versions keeps the earlier version.
QR codes, Aztec and PDF417, from the live camera, a photo or an image file. What the live camera can pick up depends on the device. QRLume reads one code per image — if a picture holds two, it reads only one of them — and it does not read 1-D barcodes such as UPC, EAN or Code 128.
No. QRLume does not look codes up in any threat database or reputation list. Its verdict comes from checks that run on your device, and the Forensic Pro report marks the threat-database result NOT CHECKED. The best result it gives is No Local Red Flags; it never calls a code safe.
