Here’s exactly how your password becomes a WQR

When you create a password, we lock it on your device first. Your master password helps derive an encryption key, and we encrypt your application password into ciphertext that looks like random noise.

After local encryption, only ciphertext is sent to our server. The connection is protected with HTTPS/TLS, so the data is encrypted while it travels over the internet.

When ciphertext arrives, the server adds an additional sealed layer using a server secret. This makes the package harder to abuse at scale and adds protection beyond what your device alone can provide.

Next we turn the protected ciphertext into a WQR code. This adds an extra layer of protection because WQR is not a “normal” QR code that any random scanner app can read.

We send the finished WQR back to your device, where it’s saved in your vault. We don’t store your vault, we don’t store your passwords, and we don’t log the secret content you create.