W2QR
Documentation Menu

How Encryption Works

The cryptographic details behind W2QR — honey encryption, Argon2id, and Strong Password derivation.

Honey Encryption

Traditional encryption (AES, ChaCha20) produces random garbage when the wrong password is used. An attacker brute-forcing passwords immediately knows when the correct one is found — the output suddenly makes sense.

Honey encryption (Juels & Ristenpart, Eurocrypt 2014) eliminates this signal. W2QR maps your mnemonic to its BIP-39 entropy bits, then XOR-masks them with an Argon2id-derived key. Because BIP-39 entropy is uniformly distributed, every key produces valid entropy — and therefore a valid mnemonic.

An attacker trying a million passwords gets a million real-looking seed phrases, each controlling a different wallet. To identify the real one, they must derive addresses from each mnemonic and check them against the blockchain — economically infeasible at scale.

Key Derivation — Argon2id

Your password is processed through Argon2id — a memory-hard key derivation function that is the OWASP-recommended choice for password hashing. W2QR uses:

  • - 64 MB memory (makes GPU/ASIC attacks expensive)
  • - 3 iterations (increases sequential time cost)
  • - 1 parallel lane (consistent across devices)
  • - 32-byte output (256-bit derived key)

These parameters are stored in the QR code, so future versions can increase them without breaking existing backups.

Honey Encryption Flow

The key derivation flow:

A = Argon2id(password, salt, 64MB, 3 iterations)
K = A[0..entropyLength]
ciphertext = XOR(mnemonicEntropy, K)

Every password produces valid BIP-39 entropy — no password verifier exists.

Strong Password Derivation

The Strong Password Generator takes a memorable phrase — your catchy phrase — and deterministically derives a cryptographic password with over 150 bits of entropy. The same phrase always produces the same password, so you can regenerate it any time.

The derived password is long and complex enough to resist brute-force attacks even from quantum computers — requiring ~10⁴⁵ years on a powerful GPU cluster, or ~175 billion years with a hypothetical quantum computer running Grover’s algorithm.

Store the generated password as a separate password QR code. Print it on a plastic card alongside your wallet QR — two credit-card-sized cards that together give you easy, durable access to your wallet. If you ever lose the password QR, simply regenerate it from the same catchy phrase.

W2QR Cards — Honey Encryption

A W2QR Card’s QR code contains random bytes generated during card creation. These random bytes are a valid honey-encrypted payload — applying any password via Argon2id + XOR produces a valid BIP-39 mnemonic. The user’s chosen password determines which wallet the card activates.

Print both your wallet QR and password QR on plastic cards for durable, portable access. Two credit-card-sized cards that together give you easy access to your wallet — no app to install, no account to create.

TOTP Secret Encryption

The TOTP (Google Authenticator) secret is stored server-side only — it is never included in the QR code. The 20-byte HMAC-SHA1 secret is encrypted at rest using KEK envelope encryption: a data encryption key (DEK) wraps the secret, and the DEK itself is derived from the server’s environment key via HKDF-SHA-256.

This provides defense in depth: a database compromise reveals only wrapped secrets, and the KEK is rotatable without re-enrolling users.

No Password Verifier

W2QR never stores a password hash, password-derived MAC, AEAD tag under a password-derived key, known plaintext sentinel, or wallet address. There is no way to check if a password is correct without deriving addresses and checking the blockchain. This is the core security guarantee of honey encryption.