Skip to main content

QR Code Encryption

Secure your QR codes with password-based encryption. Standard camera apps will show encrypted gibberish, but mini-qr can decrypt with the correct password.

How It Works​

Encryption Flow​

User Data → Password → Encryption → QR Code (encrypted)
                                        ↓
                        Standard Camera → Shows: "ENC:U2FsdGVkX1..."
                                        ↓
                        mini-qr + Password → Original Data ✓

What Happens​

  1. User enters data (e.g., "Secret meeting: Room 405")
  2. User enables encryption and provides password
  3. App encrypts data using AES-GCM algorithm
  4. QR code contains encrypted text: ENC:U2FsdGVkX1+abc123...
  5. Standard cameras decode and show gibberish
  6. mini-qr scanner detects encryption prefix and prompts for password
  7. Correct password decrypts and shows original text

Security Specifications​

FeatureSpecification
AlgorithmAES-GCM (Galois/Counter Mode)
Key Size256-bit
Key DerivationPBKDF2 with 100,000 iterations
Hash FunctionSHA-256
SaltRandom 16-byte salt (unique per encryption)
IVRandom 12-byte initialization vector (unique per encryption)
PrefixENC: for auto-detection
EncodingBase64 after encryption

Creating Encrypted QR Codes​

Step-by-Step​

  1. Navigate to Create tab
  2. Enter your sensitive data
  3. Expand Settings accordion
  4. Scroll to Encryption section
  5. Check ✅ Encrypt QR code
  6. Enter a strong password
  7. Wait for green ✅ "QR code is encrypted" confirmation
  8. Export your QR code as usual

Visual Confirmation​

When encryption is active, you'll see:

  • 🔒 Lock icon in encryption section
  • 🟢 Green success message: "QR code is encrypted"
  • 🟡 Size warning (if data increased significantly)
  • Encrypted badge above export buttons

Password Requirements​

Recommended:

  • ✅ 12+ characters
  • ✅ Mix of uppercase and lowercase
  • ✅ Include numbers
  • ✅ Include symbols (!@#$%^&*)
  • ✅ Avoid dictionary words

Minimum:

  • 1 character (not recommended for sensitive data)

Examples:

  • ❌ Weak: password123
  • ⚠️ Okay: MySecret2024!
  • ✅ Strong: kR9$mN#2pL@vB5qT
  • ✅ Strong: correct-horse-battery-staple-2024!

Scanning Encrypted QR Codes​

Detection​

mini-qr automatically detects encrypted codes by the ENC: prefix:

  • Shows 🔒 lock icon badge
  • Displays amber warning box
  • Prompts for password

Decryption Process​

  1. Scan the encrypted QR code
  2. Enter decryption password in the field
  3. Click Decrypt button (or press Enter)
  4. Success: Shows ✅ green message and displays original data
  5. Failure: Shows ❌ error message: "Decryption failed: Invalid password or corrupted data"

What Standard Cameras See​

Standard Phone Camera Scan Result:
─────────────────────────────────
ENC:U2FsdGVkX19xY2F0aW9uIG9mIHRoaXMgbWVzc2FnZSBwcm90ZWN0ZWQgYnkgQUVTL UdDTSBlbmNyeXB0aW9u...
─────────────────────────────────
[Meaningless encrypted text - cannot be decrypted]

Use Cases​

Conference & Events​

Problem: Badge QR codes expose attendee contact information
Solution: Encrypt phone/email in QR codes

  • Print badge with encrypted QR code
  • Share password only with authorized staff
  • Staff use mini-qr to scan and access info
  • Public can't read sensitive data

Secure URLs​

Problem: Private meeting links on printed materials
Solution: Encrypt Zoom/Teams links

  • Generate encrypted QR with meeting URL
  • Print on flyers or badges
  • Share password via email/SMS
  • Anyone with password can join, others can't

WiFi Credentials​

Problem: Guest WiFi password visible to everyone
Solution: Encrypted WiFi QR codes

  • Create WiFi QR code with password
  • Encrypt the entire QR code
  • Share decryption password with approved guests only
  • Unauthorized users can't extract WiFi credentials

Access Codes​

Problem: Door codes or locker combinations on printed materials
Solution: Encrypt access codes in QR

  • Generate QR with building/locker code
  • Encrypt with resident/member password
  • Post publicly without security risk
  • Only authorized people can decrypt

Personal Data Sharing​

Problem: Business cards with phone/email are publicly readable
Solution: Encrypted vCard QR codes

  • Create vCard with personal details
  • Encrypt before printing on cards
  • Share password verbally when exchanging cards
  • Prevents digital harvesting of contact info

Size Impact​

Encryption increases QR code data size by approximately 30-40%.

Example​

Original DataEncrypted SizeIncrease
"Hello World" (11 chars)~65 chars+491%
URL (50 chars)~85 chars+70%
vCard (200 chars)~280 chars+40%
Long text (500 chars)~680 chars+36%

Implications:

  • 🔺 Larger QR codes (more modules)
  • 🔺 May need to reduce error correction level
  • 🔺 May need larger print size
  • ⚠️ App shows warning if size increases >50%

Recommendations:

  • Use error correction level Q or M (not H)
  • Increase QR code print size to 3cm x 3cm minimum
  • Keep original data concise when possible
  • Test scanning after encryption

Password Management​

Password Sharing​

Secure methods:

  • ✅ In-person verbal communication
  • ✅ Encrypted messaging apps (Signal, WhatsApp)
  • ✅ Separate secure channel (email password, SMS QR code)
  • ✅ Physical written note
  • ❌ Never include password WITH the QR code
  • ❌ Never post password on same webpage/document

Password Storage​

Important:

  • ❌ App does NOT store passwords
  • ❌ No password recovery if forgotten
  • ❌ Lost password = unrecoverable data
  • ✅ Use password manager for important passwords
  • ✅ Share backup with trusted person if critical

One Password or Many?​

Single Password (same for all):

  • ✅ Easier to manage
  • ✅ Works well for batch export
  • ⚠️ If leaked, all QR codes compromised

Unique Passwords:

  • ✅ Better security
  • ✅ Limited exposure if one leaks
  • ⚠️ Harder to manage multiple passwords

Best practice: Use single password per batch/event, unique passwords for highly sensitive individual codes.

Batch Export with Encryption​

All QR codes in a batch use the same encryption password.

Workflow​

  1. Prepare CSV file with data
  2. Click Batch Export
  3. Upload CSV
  4. Enable Encrypt QR code
  5. Enter password (applies to all)
  6. Export ZIP with encrypted QR codes
  7. Share password separately with recipients

Use case: Conference badges

  • 100 badges with encrypted contact info
  • One password shared with staff
  • Staff can scan any badge to get attendee details
  • Public scanning shows only gibberish

Security Considerations​

What Encryption Protects​

  • ✅ Content privacy — Data unreadable without password
  • ✅ Unauthorized access — Only password holders can decrypt
  • ✅ Public display — Safe to post encrypted QR codes publicly

What Encryption Does NOT Protect​

  • ❌ QR code visibility — Code itself is still visible
  • ❌ Physical security — Anyone can see/photograph the QR code
  • ❌ Password guessing — Weak passwords can be brute-forced
  • ❌ Social engineering — Password can be tricked out of users

Best Practices​

  1. Use strong passwords (12+ characters, mixed characters)
  2. Share passwords securely (separate channel from QR code)
  3. Rotate passwords for sensitive applications
  4. Test decryption before distributing QR codes
  5. Keep backups of original unencrypted data
  6. Document passwords in secure password manager
  7. Use different passwords for different security levels
  8. Educate users on password importance

Troubleshooting​

"Encryption increases QR code size by X%"​

Cause: Encrypted data is ~30-40% larger
Solution:

  • Lower error correction level (Q → M → L)
  • Increase QR code print size
  • Shorten original data if possible
  • Accept larger QR code size

"Decryption failed: Invalid password"​

Cause: Wrong password or corrupted data
Solution:

  • Double-check password (case-sensitive)
  • Check for typos
  • Verify you have the correct QR code
  • Try re-scanning the QR code
  • Contact QR code creator for correct password

Encrypted QR Won't Scan​

Cause: QR code too dense or damaged
Solution:

  • Increase print size to 4cm x 4cm minimum
  • Use error correction level Q or M
  • Ensure high print quality
  • Clean camera lens
  • Improve lighting

"QR code is encrypted" Not Showing​

Cause: Encryption not applied or in progress
Solution:

  • Check password is entered
  • Wait for encryption to complete
  • Check for error messages
  • Verify encryption checkbox is enabled
  • Try refreshing page

Technical Details​

Encryption Process​

Input: "Secret data" + "myPassword123"
    ↓
1. Generate random salt (16 bytes)
2. Derive key from password using PBKDF2 (100k iterations)
3. Generate random IV (12 bytes)
4. Encrypt data with AES-GCM
5. Combine: [salt | IV | encrypted data]
6. Encode as Base64
7. Prepend "ENC:" prefix
    ↓
Output: "ENC:U2FsdGVkX19abc123def456..."

Why This Is Secure​

  1. AES-GCM — Industry standard, used by governments and banks
  2. 256-bit keys — Astronomically large key space (2^256 possibilities)
  3. PBKDF2 — Slows down brute-force attacks
  4. Random salt — Prevents rainbow table attacks
  5. Random IV — Each encryption is unique even with same password
  6. Authenticated encryption — Detects tampering

Browser Compatibility​

Uses Web Crypto API (built into modern browsers):

  • ✅ Chrome 60+
  • ✅ Firefox 57+
  • ✅ Safari 11+
  • ✅ Edge 79+
  • ✅ All modern mobile browsers
  • ❌ Internet Explorer (not supported)

Next Steps​