Question 1

Can you unlock without internet?

Accepted Answer

Storage: yes. Unlocking: no.
Your WQR vault is stored locally on your device, but unlocking is protected by an online “server shield” step. This design prevents large-scale offline brute-force attempts if someone steals or copies your vault files.

Question 2

What happens if the server is down?

Accepted Answer

If the server is unavailable, unlocking is temporarily unavailable.
Your data stays encrypted on your device and nothing is lost — but because unlocking is server-gated, you must wait until service is restored.
This same limitation also blocks attackers during an incident.

Question 3

What happens if your server is hacked?

Accepted Answer

Even in a serious server compromise, plaintext passwords still do not become readable from the server alone.

Why:
• Plaintext never reaches the server.
• Your master password never leaves your device.
• The server is designed as a “shield step,” not as vault storage.

In an incident, we can also:
• Enable emergency lock-down to stop unlock requests.
• Rotate the server-side hardening secret (“pepper”) to contain the attack.

Question 4

How does QR code as storage work?

Accepted Answer

In WQR, your secrets are stored as encrypted WQR code files.
A WQR code holds ciphertext (encrypted data), not plaintext (readable data).
Example: plaintext might be “MyEmailPassword123”, while ciphertext looks like random characters.
The app stores these WQR codes inside your device’s protected app storage unless you export them.

Question 5

Why use QR / WQR at all?

Accepted Answer

WQR storage gives practical benefits:
• Portability: your secrets can be moved as secure files.
• Controlled transfer: share by scanning/importing, not by sending raw text secrets.
• Extra friction against casual scanning: WQR is not a standard QR that random scanner apps can decode.

Important: encryption is the main protection. WQR adds practical, real-world safety benefits.

Question 6

Do you store my vault?

Accepted Answer

No.
We don’t store your vault in an unknown online database.
Your vault consists of encrypted WQR codes stored locally on your device, protected by your device security (and inside the app).
The server assists only with security operations (the server-gated unlock step).

Question 7

What if they steal my device?

Accepted Answer

If someone steals your device, they still face multiple barriers:
• Your device protection (PIN/biometrics).
• Your WQR app vault protections.
• Encrypted WQR storage (ciphertext, not plaintext).
• Server-gated unlock, which prevents offline brute-force at scale.

Question 8

What if someone takes a picture of my WQR code?

Accepted Answer

A photo of a WQR code is still encrypted ciphertext.
Without the correct master password (and the server-gated unlock step), it remains unreadable.

However, treat WQR images as sensitive:
• Don’t post them publicly.
• Don’t store them in places you don’t trust.
Encryption protects you, but good hygiene protects you even more.

Question 9

Isn’t showing a QR code a security issue since people can see it?

Accepted Answer

Seeing a WQR code is not the same as seeing your password.
A WQR code is an encrypted container. A viewer cannot “read” your password from it without the required unlock steps.
Still, showing sensitive codes in public is not recommended — avoid unnecessary exposure.

Question 10

More master passwords is pain — why have more instead of one?

Accepted Answer

You don’t have to use more than one.
WQR supports multiple master passwords as an option to reduce “blast radius.”
If one master password is ever compromised, it should not automatically unlock your entire digital life — only the entries protected by that master.

Question 11

Should I create strong passwords?

Accepted Answer

Yes.
We require strong master password rules, and we strongly recommend generating strong passwords for accounts.

Tip:
• Generate strong passwords for websites/apps.
• Use a strong master password you can reliably remember (and never reuse elsewhere).

Question 12

Do you have Autofill?

Accepted Answer

Yes — Autofill is available on Desktop and Android.
WQR also supports secure workflows for getting your data where you need it (for example: protected templates and safer copy usage).

Question 13

What is phishing?

Accepted Answer

Phishing is when attackers trick you into entering your credentials on a fake website or fake login screen.
It often looks real — same logo, same design — but the site is controlled by attackers.

A password manager can help reduce phishing risk by:
• Showing you the correct site/app identity.
• Warning when something doesn’t match.
• Reducing “copy/paste into unknown places” habits.

Question 14

Can I store anything else in the password place, like my Wi-Fi password or bank details?

Accepted Answer

Yes.
Anything sensitive can be stored as an encrypted WQR entry (or document).

For Wi-Fi sharing, you can also generate a standard Wi-Fi QR code — but remember:
standard QR codes are not encrypted like WQR codes, so only use that when you intentionally want a shareable code.

Question 15

Does plaintext ever leave my device?

Accepted Answer

No.
Plaintext is decrypted only on your device.
It exists briefly in memory when you view/use it, and it is never sent to the server and never logged.

Question 16

What do you log?

Accepted Answer

We keep minimal operational logs to run and defend the service, such as:
• Timestamps of requests.
• Error codes.
• Rate-limit / abuse signals.
• Basic service health metrics.

We do not log:
• Plaintext secrets.
• Decrypted passwords.
• The secret content inside your WQR codes.

Question 17

Is WQR security based on “custom QR”?

Accepted Answer

No — encryption is the primary security.
WQR is a custom QR-like format that adds practical protection:
• Prevents casual scanning by random apps.
• Improves safe storage/transfer workflows.

But even if someone could decode the WQR format, they would still only obtain ciphertext.

Question 18

Can I export / migrate out anytime?

Accepted Answer

You can export your WQR codes (encrypted) as files for backup or transfer.
If you want to migrate to another manager, your ability to do so depends on the export options you enable.

A safe approach is:
• WQR export (always available).
• Optional standard exports (only if you choose and accept the tradeoffs).

(Export/import options are still being refined.)

Question 19

What if I forget my master password?

Accepted Answer

For security reasons, we cannot recover it.
We do not store your master password, and without it your encrypted data cannot be decrypted.
We recommend an emergency plan (offline backup + clear recovery rules).

Question 20

Can my account be recovered if I lose my master password?

Accepted Answer

Yes — your account is not tied to your master password.
The password you use to log in should not be the same one you use to encrypt your secrets.
WQR uses passkeys, email verification, and (when needed) 2FA. A traditional password may be used only for account recovery.

Question 21

Is there an audit / bug bounty?

Accepted Answer

Our goal is third-party validation.
• Audit: planned.
• Bug bounty: planned — we may offer rewards such as a few months of Fortified subscription for valid reports.

Question 22

Are you open source?

Accepted Answer

Partially, for now.
We allow security-focused code review for verification and audits, but we do not currently publish the entire codebase for unrestricted commercial use.

Even before a full program, we maintain a Responsible Disclosure policy so researchers can report issues safely.

Questions & Answers