The Idea

W2QR gives you cold-wallet security without the hardware. No device to buy, no software to install, nothing stored on any server or device. Your encrypted QR code is your wallet — scan it on any device with a browser, enter your password, and you are in.

The encryption is designed so that every password creates a valid seed phrase. An attacker who steals your QR can try millions of passwords — every single one will produce a real-looking wallet with real addresses. There is no way to tell which result is the real one. This is what makes brute-force attacks pointless.

For even stronger protection, add a second factor — your Google account, your device biometrics, or a Google Authenticator code. You can also split recovery across multiple locations using Shamir shares, so no single point of failure can lock you out.

Security Modes

Basic is the right choice for quick backups. Advanced adds a safety net for high-value wallets. W2QR Cards let you start from a physical card and activate it with your password. Shamir enables distributed custody where no single person holds full access.

No Hardware. No Installation. Nothing Stored.

W2QR replaces hardware wallets like Ledger Nano or KeepKey. No device to buy, no software to install. Your QR is your cold wallet — scan it on any device with a browser. All encryption and decryption happens entirely in your browser. No server ever sees your password, seed phrase, or private keys.

You can also import your decrypted seed phrase into any BIP-39 compatible wallet app. W2QR is a protection layer, not a lock-in.

How It Works

Technology

• -Honey encryption — Juels & Ristenpart (Eurocrypt 2014). XOR of BIP-39 entropy with Argon2id-derived key. Every password yields a valid mnemonic.
• -Argon2id — 64 MB memory, 3 iterations. OWASP-recommended memory-hard key derivation.
• -HKDF-SHA-256 — Domain-separated key derivation for Advanced mode. Combines password output with authorization secret S.
• -AES-256-GCM — Authenticated encryption for recovery ciphertext and key wrapping.
• -Shamir Secret Sharing — GF(256) polynomial splitting: 2-of-3 threshold for disaster recovery.
• -WebAuthn PRF — Device-bound key derivation via biometric authenticator (Face ID, Touch ID, Windows Hello).
• -TOTP (Google Authenticator) — Time-based one-time passwords as a second factor. The secret is stored server-side only, never in your QR.
• -W2QR Cards — Pre-printed cards with QR codes that become wallets upon activation. Design, print, and activate your own crypto wallet card.
• -Client-side WebAssembly — All cryptography runs in-browser. No server ever receives your password, mnemonic, or private keys.

Backward Compatibility

W2QR reads QR codes from all previous versions including the original text2qr.com format, Basic, and Advanced. All legacy formats are fully supported. Your old backups will always work.

Finding assets you have lost track of

When you open a wallet, W2QR automatically checks the hundred most likely places your assets could be — ten derivation paths across six EVM networks, plus Bitcoin, Solana and Zcash. That covers the overwhelming majority of real wallets, and it is free every time you unlock.

Some wallets do not fit that pattern. You may have used an unusual derivation path, a high account index, or a network outside the standard set. And some people arrive here having lost part of their seed phrase entirely.

The Non-Zero Balances Scanner is for those cases. You define the search yourself — which networks, which assets, which derivation paths, which index ranges. The app counts exactly how many requests that search needs and shows you the price before you commit to anything. Estimates are free and unlimited; you can widen and narrow the search as many times as you like.

If you are missing one word of a twelve- or twenty-four-word phrase, the scanner can enumerate every valid completion — there are far fewer than people expect, because the BIP-39 checksum eliminates all but a fraction of a percent — and search each one.

Your phrase never leaves your browser. Candidate phrases are derived locally, and only the resulting public addresses are sent for balance lookup. The report that contains your recovered phrase is assembled in your browser and downloaded directly; it is never uploaded to us.