W2QR White Paper
Two QR Codes.
Zero Installations.
A wallet QR and a password QR — backed by honey encryption and a quantum-resistant password derived from a phrase you can remember. No app to install, no secrets stored on any device.
Quick & Friendly
Scan two QR codes in any browser — no app, no extension, no account. Your wallet opens in seconds.
Easy Recovery
Wallet QR backed up to Google Drive. Password regenerated from the same catchy phrase anytime. Nothing to lose.
Quantum Resistant
Honey encryption + 150+ bit password from your phrase. Brute-force: ~1045 years classical, ~175 billion years quantum.
$2.2B
Crypto stolen in 2024
$1.2B
From private-key exploits alone
$438M+
Drained via weak master passwords (LastPass)
~$400B
Permanently lost (forgotten keys)
The Problem
Traditional self-custody wallets have two fundamental vulnerabilities. In 2024, personal wallet compromises grew to 44% of all stolen crypto — up from 7% in 2022. Over 80,000 unique victims lost $713M in the first half of 2025 alone.
Device-Level Attacks
$1.2B lost in 2024
All standard wallets store encrypted seed phrases locally on your device. Malware, compromised backups, or physical access to the file system exposes the encrypted data. In 2024, private-key exploits caused $1.2 billion in losses across 47 attacks — 69% of all crypto theft in early 2025.
Weak Password Protection
$438M+ drained (LastPass breach)
With standard encryption, a wrong password produces gibberish — so an attacker knows instantly when they have guessed correctly. The 2022 LastPass breach exposed encrypted vaults, and brute-forcing weak master passwords has drained $438M+ through 2025 — including $150M from Ripple co-founder Chris Larsen.
How traditional wallet attacks work
The W2QR Solution
W2QR eliminates both attack surfaces by removing secrets from devices entirely and making password guessing mathematically pointless.
Honey Encryption
Every password — right or wrong — produces a valid BIP-39 mnemonic with real wallet addresses. An attacker trying a million passwords gets a million plausible wallets. There is no way to tell which one is real without checking every derived address on the blockchain.
Mnemonic-Based Strong Password
Choose an easy-to-remember phrase in any language — for example, "I was born in London, and my whole family is from that same area." W2QR derives a cryptographic password from it. The generated password is long and complex, but you never need to memorize it — store it as a password QR code that you scan when opening your wallet.
Zero Footprint on Devices
No app install required. Open your wallet in any browser with your QR + password. All encryption and decryption runs client-side. No data remains on the device after locking — nothing to find, nothing to steal.
Safe Anywhere Backup
Print your QR, save it as an image, or back it up to Google Drive. The QR is safe to store anywhere — even publicly — because without your mnemonic password, brute-force is futile.
Plastic Cards for Both QR Codes
Print your wallet QR and your password QR on credit-card-sized plastic cards. Two cards, two locations — wallet access is as simple as scanning both. Even if someone finds one card, it is useless without the other: honey encryption blocks the wallet card, and the password card alone opens nothing.
Flow 1
Create Your Protected Wallet
Wallet QR
Your seed phrase
scare spoil dash river execute undo illness return aisle scene infant quarter
Wallet QR
Honey-encrypted
Password QR
Your catchy phrase
“A língua materna dos meus pais é o português.”
Generated strong password
WeBLeY0S#od9#@0KltV_!d5n
Password QR
>150 bits entropy
Flow 2
Access Your Wallet
Wallet QR
Scan
Password QR
Scan
Wallet Open
In your browser
No app to install
Decryption runs client-side
Zero data on device after lock
W2QR vs Traditional Wallets
| Feature | Traditional Wallet | W2QR |
|---|---|---|
| Secret storage | Encrypted file on your device | QR code — not on any device |
| Wrong password output | Random gibberish (instant rejection signal) | Valid mnemonic (no rejection signal) |
| Brute-force viability | Feasible with fast hardware | Each guess requires blockchain verification |
| Device compromise | Encrypted data exposed | Nothing to find on the device |
| Password strength | Must be strong and memorized | Easy-to-remember phrase → crypto-grade key |
| Backup | Risky — file must stay secure | Print or store QR anywhere safely |
| Installation | Required (desktop or mobile app) | None — pure browser |
| Data after lock | Encrypted file remains | Zero — nothing persists |
Password Strength: Mnemonic Phrase Model
A user-chosen natural-language phrase is transformed into a cryptographic password. The entropy of a meaningful sentence far exceeds typical passwords.
| Password type | Entropy | Power desktop PC | Quantum computer |
|---|---|---|---|
| P@ssw0rd!23 | ~40 bits | ~seconds | instant |
| kX9$mPq2vL!nR7wZ | ~95 bits | ~1012 years | ~months |
| "A língua materna..." | >150 bits | ~1045 years | ~175 billion years |
Power desktop PC: high-end GPU cluster at 10 billion guesses/sec. Quantum computer: Grover's algorithm (quadratic speedup) on a hypothetical large-scale quantum computer. W2QR also uses Argon2 memory-hard KDF, adding ~1 second per attempt regardless of hardware.
Security Model
- ✓All encryption/decryption runs client-side in the browser — the server never sees your password, mnemonic, or private keys
- ✓No password verifier is stored anywhere — there is nothing for an attacker to validate guesses against
- ✓Memory-hard key derivation (Argon2) makes each password attempt computationally expensive
- ✓Honey encryption ensures every decryption attempt produces a valid-looking result
- ✓Zero data persistence on the device after wallet lock
- ✓Optional multi-factor security: QR + password + biometrics, Google Account, or authenticator app
- ✓Shamir secret sharing for distributed backup across multiple trusted parties
Two QR Codes. One Catchy Phrase. Full Control.
No installs. No data on your device. No way for attackers to verify a password guess. Quantum-resistant protection backed by Google Drive recovery. Scan two codes and you’re in.
Sources & References
- $2.2B stolen in 2024 — Chainalysis, "2025 Crypto Crime Report"
chainalysis.com/blog/crypto-crime-mid-year-update-2024 - $1.2B from private key compromises (47 incidents, 2024) — Chainalysis, "Private Key Compromises"
chainalysis.com/blog/crypto-hacking-stolen-funds-2025 - 69% of H1 2025 losses from private key exploits — Immunefi, "Crypto Losses in 2025"
immunefi.com/research - $438M+ drained via LastPass breach (2022–2025) — Security researchers & on-chain analysis
krebsonsecurity.com — LastPass breach key cracking - Personal wallets: 7% → 44% of stolen crypto (2022–2024) — Chainalysis annual reports
chainalysis.com/blog/2024-crypto-crime-mid-year-update - 80,000+ unique victims, $713M lost in H1 2025 — FBI Internet Crime Complaint Center (IC3)
ic3.gov — 2024 IC3 Annual Report (PDF) - 2.3–3.7M BTC permanently inaccessible (~20% of supply, ~$400B) — Chainalysis & Glassnode on-chain analysis
chainalysis.com — Bitcoin supply analysis