Documentation Menu
W2QR Cards
Pre-printed QR cards that become wallets when activated with a password.
What are W2QR Cards?
W2QR Cards are pre-printed physical or digital cards containing a QR code with honey-encrypted data. The card does not hold any specific wallet — instead, when you activate it with a password, honey encryption derives a valid BIP-39 mnemonic from the card’s data. Your password choice determines which wallet is created.
You can design and print cards before any wallet exists. When you’re ready, scan the card, enter a password, and your wallet is created. Optionally upgrade to Advanced security by adding Google Account + biometric + Recovery Code.
Creating a card
Use the Card Designer to create a card. Choose from 5 templates (Midnight, Ocean, Emerald, Graphite, Light), add a nickname and wallet code, then print or download your card.
The card’s QR code contains randomly generated honey-encrypted data. Because of W2QR’s honey encryption, any password applied to this data will produce a valid BIP-39 seed phrase — there is no “correct” or “incorrect” password built into the card.
Activation flow
- Scan the card — use your camera or upload a photo of the QR code. W2QR detects the card data and presents the activation flow.
- Choose a password — your password, combined with the card’s QR data, creates your unique wallet. Honey encryption ensures every password produces a valid mnemonic — your choice determines which wallet you get.
- Save your recovery phrase — the resulting 12 or 24-word BIP-39 mnemonic is displayed. Write it down and store it safely — this is your wallet’s recovery phrase.
- Choose security level — stay with Basic (password-only) or upgrade to Advanced for multi-factor security with Google Account, device biometric, and Recovery Code.
- Advanced setup (optional) — sign in with Google, register device biometric (Face ID, Touch ID, Windows Hello), and save your Recovery Code. The system re-encrypts your wallet as V2A with full multi-factor protection.
Your card is now activated. If you chose Advanced, a new digital QR is generated containing the V2A packet with full multi-factor protection.
Security: Basic vs. Advanced activation
- • Password-only encryption
- • Honey encryption — every password produces a valid mnemonic
- • No authorization secret
- • No device binding
- • No recovery options
An attacker who obtains the card must still brute-force the password and check each candidate on-chain, but there is no server-side factor blocking access.
- • Multi-factor security
- • Authorization secret S (server-held, KEK-wrapped)
- • Device biometric binding (WebAuthn PRF)
- • Google Account protection
- • Recovery Code for emergencies
- • Optional TOTP (Google Authenticator)
An attacker needs the password and a second factor (biometric, TOTP, or Recovery Code) to decrypt. The server never releases S without proper authorization.
How the card relates to the activated wallet
If you chose Basic activation, the card’s original QR code is your wallet. Use the same card and password to access your wallet any time.
If you chose Advanced activation, the system generates a new digital QR containing a V2A packet with the authorization secret, recovery shares, and all multi-factor bindings. The physical card still works as a basic-mode fallback with password-only access.
Your primary backup for an Advanced wallet should be the activated digital QR. Keep the physical card as a secondary backup in a separate secure location.
Important notes
Remember your password. The card’s honey encryption means there is no “wrong password” error. If you forget which password you used, you will derive a different wallet. There is no way to recover the original password from the card.
The physical card has Basic security only. The printed QR on the card always provides password-only access with honey encryption. Even after Advanced activation, anyone who obtains the card and knows the password can decrypt the seed phrase without needing biometrics or server authorization.
Treat the physical card with the same care you would give to any seed phrase backup. If the card is compromised, move funds to a new wallet.