W2QR Encryption
Unbreakable by Design
Any password produces a valid wallet. There is no way to know which result is the real one. An attacker who tries every possible password gets millions of valid-looking wallets — but has no way to tell which one holds real funds.
Why most encryption fails against brute force
Most encryption produces random garbage when you enter the wrong password. An attacker trying passwords can instantly tell when they guess correctly — the output suddenly turns into readable data.
The attacker knows the moment they succeed — the output changes from random bytes to real words.
W2QR: every password creates a real wallet
W2QR uses a fundamentally different approach. Every password produces a valid wallet with real words. The attacker has no signal — every attempt looks correct. There is no way to reject a wrong guess.
Every result is a real seed phrase controlling a real wallet. Only the correct password (highlighted) produces your wallet — but there is no way to tell which one it is without checking the blockchain.
How it works
Creating your backup
Unlocking with any password
The math behind the encryption guarantees that every password — right or wrong — produces a valid set of wallet words. Each attempt takes about half a second due to the memory-intensive key derivation, making mass guessing slow and expensive.
What an attacker faces
They obtain your QR code — they have the encrypted data.
They try a million passwords — each one takes ~0.5 seconds. That alone takes about 6 days.
They get a million valid wallets — every single one looks real. No errors, no failures. Just a million wallets.
They must check each one on the blockchain — look up balances for every wallet on every network. Expensive and slow.
Result: not worth trying — the combination of slow password processing and mandatory blockchain checking makes brute force economically pointless.
Additional layers make it even harder
Even without any extras, the encryption is already impractical to crack. But W2QR offers additional security layers that make brute force completely impossible — even for an attacker who has your QR and knows your password.
Google Account — a secret stored server-side is required to decrypt. The attacker needs both your password and access to your Google account.
Device Biometric — your phone or laptop fingerprint/face scan unlocks a key stored on that device only. Even with your password and Google account, the attacker still needs your physical device.
Google Authenticator (TOTP) — a 6-digit code that changes every 30 seconds. Works as an alternative second factor when your registered device is unavailable.
Shamir Shares — split your recovery into pieces stored in different locations. No single person or location has enough to reconstruct your wallet.
Each layer multiplies the difficulty. With even one additional factor, brute force goes from “economically pointless” to “mathematically impossible.”
Cold-wallet security. No accessories. No installation.
No hardware needed
W2QR gives you the same level of protection as a hardware cold wallet — without buying a Ledger, KeepKey, or any other device. Your QR code is your cold storage.
Fully browser-based
No app to install. No extension. No software to keep updated. Open any browser on any device and unlock your wallet instantly.
Nothing stored anywhere
No data is saved on your device or on any server. Your password, seed phrase, and private keys exist only in your browser's memory while you use them — and are erased when you close the page.
At a glance
| Traditional encryption | W2QR encryption | |
|---|---|---|
| Wrong password output | Random garbage | A valid wallet |
| Can the attacker tell? | Instantly — output changes type | Never — all outputs look the same |
| Cost to verify each guess | Free | Must check the blockchain |
| Password hint stored | Often yes | Never — nothing to compare against |
| Data on your device | Varies | None — everything in the QR |
| Hardware required | Often (hardware wallet) | None — just a browser |
Honey Encryption in W2QR Cards
A W2QR Card contains random bytes that are already valid honey-encrypted data. When you activate the card with a password, honey decryption produces a valid BIP-39 mnemonic. Every password produces a different, valid seed phrase — the password you choose during activation determines which wallet is yours.
An attacker who obtains the card cannot determine which password was used to activate it. The QR data looks random, every password produces a valid wallet, and there is no password oracle or verifier. Only the user who chose the password knows which wallet is theirs.
Plastic cards preserve honey encryption
A pre-printed W2QR plastic card starts with Basic-mode honey encryption. When you activate the card, full multi-factor security is layered on top — authorization secret, recovery shares, and cloud backup — but the printed QR code does not change. The honey encryption guarantee remains intact: any password still produces a valid wallet from the printed QR. Activation adds protection for accessing your wallet on new devices, not a password verifier.