QR stolen (Basic mode)

Honey encryption: every password produces a valid mnemonic. The attacker gets millions of plausible wallets with no way to identify yours. Argon2id (64 MB, 3 iterations) makes each attempt slow. W2QR Cards use the same honey encryption — each card's QR data produces a valid wallet for any password.

QR stolen (Advanced mode)

The attacker also needs the authorization secret S (from your device or Google account). Without S, decryption still produces valid-looking mnemonics — but wrong ones. QR + password alone is not enough. If TOTP is enrolled, accessing S on a new device also requires a valid 6-digit code — adding a time-based barrier that cannot be brute-forced offline.

Share stolen (Shamir Shares mode)

A single share reveals zero information about the mnemonic — this is an information-theoretic guarantee. The attacker needs M shares AND each share's password. Even with fast brute-forcing, the search space is P^M (exponentially harder than attacking a single QR).

Brute-force attack

No oracle: the attacker cannot tell when they've guessed correctly. They must check each candidate mnemonic against the blockchain — infeasible at scale. Every password attempt produces a valid-looking wallet, forcing the attacker to check each one on-chain.

Server compromised (Advanced mode)

The server stores only KEK-wrapped S and R1 share, linked to a hashed Google subject ID. Without your password (which the server never receives), S is useless. R1 alone cannot reconstruct the recovery root — 2 of 3 shares are needed. The TOTP secret is also KEK-encrypted on the server — a database breach yields only ciphertext, not usable codes.

Google Account compromised

A compromised Google Account can release the wrapped S and R1 share, but these are encrypted under the server KEK. Even with both, the attacker needs your password to decrypt. If TOTP is enabled, new-device access also requires a valid 6-digit code, adding another barrier even if the Google Account is taken over. Google never receives your password, mnemonic, or private keys. Google Drive backups are also ciphertext only.

Device lost or reset

WebAuthn credentials and the device-bound S are lost, but you can recover using Google Account sign-in (which releases R1). Re-enroll a new device after recovery. If TOTP (Google Authenticator) is enrolled, it provides an alternative path to release S on a new device — as long as you have your authenticator app.

Browser compromised

During unlock, the mnemonic exists briefly in browser memory. A fully compromised browser can intercept it. This is the same threat model as typing a password on any web page. Use a clean browser profile.

Man-in-the-middle

All cryptography runs client-side in the browser. The encrypted payload never transits the network in cleartext. API routes that release secrets use rate limiting, IP throttling, and response timing normalization.

TOTP protection

Lost or stolen device? TOTP (Google Authenticator) provides an alternative second factor for releasing your authorization secret on new devices. The TOTP secret never leaves the server — it is stored KEK-encrypted and rate-limited with lockout after consecutive failures.

W2QR Cards — physical wallet creation

A pre-printed card uses honey encryption — any password produces a valid mnemonic. An attacker who obtains the card cannot determine the correct password or the real wallet. After activation, the card can be upgraded to Advanced mode with full multi-factor protection.

Plastic card security

A pre-printed card starts with Basic-mode encryption only. After activation (password + second factor), full multi-factor security is added — authorization secret, recovery shares, and cloud backup — without changing the printed QR code.