QR Fire

The brief

QR codes are on restaurant tables, posters, parcels, Wi‑Fi cards and event tickets, and you can’t read one by looking at it. Every scan is a small act of trust: the phone turns a square of dots into a link, a contact or a network password, and the usual next step is to open whatever came out. The category is crowded, so the bar for another scanner is simple — it has to be quicker to use and clearer about what it’s about to do than the one already on the phone.

QR Fire first shipped in April 2023 as a plain scanner with a history, and the only thing it could act on was a link. Version 2 is a ground-up rewrite, but it went out as an update to the same store listings, which set the brief: a scanner that understands what it reads and says so plainly before you tap anything — and that people who had used the old app for three years could update without losing their history, their settings or the Remove Ads purchase they had already paid for.

The details

The result sheet is what the app is for, so the decision behind it came first: the scanner only hands over a string, and QR Fire’s own parser decides what it means. It works from that raw text alone — never the scanner’s structured fields — so a live scan, a photo, a code made in the app and a row saved by the 2023 version all get the same answer. Each kind then gets one primary action and up to three more, most useful first. A Wi‑Fi code shows the network and security type, keeps the password hidden behind a reveal button, and leads with Copy password; a contact or event is handed to the phone as a standard vCard or calendar file; a barcode searches the web, and a 13‑digit code starting 978 or 979 is labelled as a book. Nothing opens by itself, and the camera pauses while the sheet is up, so a code still in view can’t fire twice.

Link safety is worked out from the address itself, on the phone, rather than by sending every scan to a lookup service — the app never visits the links it reads. It checks for four tricks: internationalised domains that can imitate a familiar name with look‑alike characters, raw IP addresses in place of a website, an “@” that hides the real destination (google.com@evil.example really opens evil.example), and plain unencrypted HTTP. The first three get a red warning that names the real host; HTTP on its own gets a milder note not to enter passwords or card details. The trade-off is deliberate: with no reputation database it can’t know that a well-formed HTTPS domain is a scam, but it catches the tricks that live in the shape of the address, and it does so before the tap rather than after.

Shipping as an update meant the rewrite could break nothing. Version 2 opens version 1’s database exactly as it was — same directory, same entity, its first six fields untouched — and every field added since has a default, so old rows read back cleanly, including ones where v1 had stored the word “null” instead of a value. Old settings are read once from the previous storage file and then deleted. Payments changed underneath: v1 went through RevenueCat, while v2 talks to Google Play Billing and StoreKit 2 directly, using the same product IDs, so the stores themselves recognise past buyers. Ownership is checked silently at every launch, a cached flag means a paying user never sees an ad flash up while the store answers, and it is only ever granted, never taken away automatically — an empty reply from an offline phone is not proof of a refund.

The outcome

QR Fire 2.0 is live on Google Play and the App Store as an update to the original listings, so people who installed the first version kept their history, settings and Remove Ads purchase. It reached Google Play on 9 October 2026 and the App Store later that month. It is free with a banner ad, with Remove Ads as a one-time purchase, runs on Android 7.0 and iOS 15.0 and up, on phones and tablets, and is backed by 38 automated tests.