W2QR

Recovery & Backup

W2QR provides simple, reliable ways to recover your wallet: Google Drive backup for your QR, password regeneration from your catchy phrase, and Shamir share combine.

Password-Based Access

The primary way to access your wallet is with your encrypted QR and your password. Scan the QR (or upload, paste, or restore from Google Drive), enter your password, and W2QR decrypts your seed phrase in your browser using WebAssembly. No server interaction is needed for password-based decryption.

If you used the Strong Password Generator, you can regenerate the password from your memorable phrase at any time — the derivation is deterministic.

Google Drive Backup

Back up your encrypted QR data to Google Drive using Cloud Backup. The backup is ciphertext — Google stores the file but cannot read your password, seed phrase, or private keys.

If you lose your QR code, restore the encrypted data from Google Drive. This is equivalent to scanning the printed QR or uploading a photo — the restored data is still ciphertext and requires your password to open.

Password Recovery via Catchy Phrase

If your password was generated using the Strong Password Generator from a memorable phrase, you can recover it by entering the same phrase again. The generator uses a deterministic derivation — the same phrase always produces the same password.

This means your password QR is also recoverable: regenerate the password, then create a new password QR. Your memory of the phrase is the backup.

Recovery scenarios

LostRecover with
Lost QR code / wallet cardRestore encrypted data from Google Drive backup
Lost password QR / cardRegenerate password from your catchy phrase (Strong Password Generator)
Lost both cardsGoogle Drive backup + phrase regeneration → full recovery
New deviceScan your QR or restore from Drive. Re-enroll biometrics from Biometry / Pincode if needed
Forgot your catchy phraseNo password recovery — the phrase is the only password backup (by design)
Have Shamir sharesCollect the required number of shares and combine them to reconstruct the mnemonic

Shamir Share Combine

If you created Shamir shares as a backup, you can recover your wallet by combining the required number of shares (M of N). Each share is independently encrypted — you need both the share data and its password to use it.

Go to Shamir Shares to combine shares and reconstruct your mnemonic. The combine process runs entirely in your browser.

Biometric / PIN Protection

When you enroll biometric protection from Biometry / Pincode, opening the wallet requires an additional verification step on the enrolled device after entering your password. This uses WebAuthn (Touch ID, Face ID, Windows Hello, or device PIN).

Biometric credentials are stored locally in your browser (IndexedDB) and bound to your device hardware. If you reset your device or clear browser data, the credentials are lost — but you can still open the wallet with your QR + password on any device, then re-enroll biometrics.

W2QR Card & Plastic Card recovery

Cards use the same honey encryption as any W2QR wallet. Recovery follows the standard process: if you lose the card, restore from Google Drive backup. If you forget the password, regenerate it from your catchy phrase (if you used the Strong Password Generator).

The physical card remains usable with its original password. Honey encryption means any password produces a valid mnemonic, but only the original password produces the correct wallet.

Recovery Codes (Legacy)

Earlier versions of W2QR issued recovery codes (starting with RC1-). Recovery codes are no longer generated for new wallets. If you have an existing wallet with a recovery code, it will continue to work for that wallet.

Trust boundaries

Google Drive stores only encrypted ciphertext. The W2QR server never receives your password, seed phrase, or private keys. The system is designed so that no single point of failure can expose your seed phrase — your QR + password is the only combination that opens your wallet.

Read the full security model →