Table of contents

• What is QR SafeShare?
• Key features
• Use cases
• How does splitting work?
• How does combining work?
• 3D-printable QR codes
• Protective Sleeve
• Install as an App (PWA)
• For the technically inclined
• Shamir’s Secret Sharing explained
• Storing QR codes on a Linux server
• Embed payload in your own HTML
• FAQ

What is QR SafeShare?

QR SafeShare is a free tool that lets you split a password, recovery phrase, or any text into multiple QR codes. The project is fully transparent: all code is published on GitHub for anyone to review. It uses mathematical techniques (XOR and Shamir’s Secret Sharing) to ensure that a single share is useless on its own. Only by combining the required shares can the original secret be reconstructed. Everything runs locally in your browser. Nothing is ever sent or stored online.

Key features

• Split secrets into QR codes: works with passwords, recovery phrases, or any text.
• Recover easily: scan or upload the required QR codes to restore the original secret.
• Runs locally: all encryption and splitting happens in your browser. Nothing is sent or stored online.
• 3D-print export: create durable, physical backups of your QR codes with 3MF files.
• Extra protection: use the lockable QR SafeShare Sleeve (available on Printables) to prevent unwanted scanning.

Use cases

Here are some practical scenarios where QR SafeShare makes sense:

1. Protecting a crypto recovery phrase

Recovery phrases are extremely sensitive. A CryptoSteel is durable, but if a burglar finds it, they have your entire phrase. Digital backups can be corrupted or hacked. Splitting a metal backup in two also isn’t secure, since each half exposes part of your phrase and you no longer know the whole thing yourself.

With QR SafeShare you can use Shamir’s Secret Sharing (3-2) to create three QR codes where any two are enough to recover your phrase. Export them as 3MF files to 3D-print durable offline backups. Store one in a safe, one digitally, and one with a trusted person. Even if one code is lost or stolen, your funds remain secure. A single QR is useless on its own, even against future quantum computers.

2. Sending a password securely to a client

Sending a password over a single channel like email is risky. If intercepted, the secret is exposed. With XOR 2-2 splitting you divide the password into two QR codes. Each part on its own is useless.

You can send one part via WhatsApp or SMS as a special link that opens the Combine page with the first QR preloaded. The second QR is sent as an image by email. When your client opens the link and scans the second QR, the password is reconstructed locally in their browser. If one channel is compromised, nothing is revealed.

3. Dead man’s switch for a password vault

A dead man’s switch is a system that checks if you are still alive or active. It sends you periodic messages, and if you stop responding it automatically triggers an action, such as sending an email.

If you simply email a password, it may sit unprotected in someone’s inbox and be intercepted — creating a single point of failure.

With XOR 2-2, you split the master password of a password vault into two parts:

• One QR code is stored on a USB stick together with the encrypted vault itself. The USB stick is then placed in a physical safe.
• The dead man’s switch sends the second part as a special link to a family member who should receive access if something happens to you.

Only by combining the USB QR with the emailed link locally in the browser can the vault password be reconstructed. A hacker who only has the email, or a burglar who only steals the USB from the safe, gains nothing.

How does splitting work?

You enter your secret (for example a password or recovery phrase). The tool uses mathematical calculations to create multiple shares. Each share is shown as a QR code and can be stored or shared separately.

How does combining work?

Combining only works through the official Combine page. You cannot recover your secret with a generic QR scanner. Only by scanning or uploading the required QR fragments on the Combine page will the original secret be reconstructed.

3D-printable QR codes

With QR SafeShare you can not only store your secret QR codes digitally, but also export them as a 3MF file. This format is directly supported by most 3D printers and lets you create a durable, physical backup of your secret.

Why is this useful? Paper can tear, fade, or burn. Digital storage can be hacked, corrupted, or lost. A 3D-printed QR is durable, tangible, and completely offline — a secure backup you can actually hold in your hands.

Protective Sleeve

Want to prevent someone from scanning your printed QR code without permission? Use the QR SafeShare Sleeve. Slide the QR code inside and secure it with a padlock. With the lock in place, the QR cannot be removed or scanned.

👉 Download the lockable QR SafeShare Sleeve on Printables

Install as an App (PWA)

QR SafeShare can also be installed as a Progressive Web App (PWA) for quick access, just like a native app. Once installed, it runs fullscreen and can be used completely offline.

• On Android (Chrome / Edge / Brave): open qrsafeshare.com, tap the ⋮ menu, and choose “Add to Home screen”.
• On iOS (Safari): open qrsafeshare.com, tap the Share button, and select “Add to Home Screen”.
• On Desktop (Chrome / Edge / Brave): open qrsafeshare.com, click the install icon in the address bar or go to ⋮ → Install app.

For the technically inclined

QR SafeShare supports two mathematical methods:

• XOR: the secret is combined with random data. A single share contains no information. Two shares are required to get the secret back.
• Shamir’s Secret Sharing: a well-known cryptographic method where the secret is embedded in a polynomial. You can configure how many shares are required to reconstruct the secret.

Both methods are mathematically secure as long as you follow the rules. Everything runs client-side in your browser with JavaScript.

Shamir’s Secret Sharing explained

With Shamir’s method, the secret is embedded in a polynomial. You can configure how many QR codes (shares) are required to reconstruct the secret. This allows flexible schemes such as 2-out-of-3, where you can lose one QR but still recover your backup.

Storing QR codes on a Linux server

On Linux you can use the qrencode tool to generate QR codes directly from a text file. This allows you to keep your QR code data safely on your own system, without ever relying on an external website or service.

1. Prepare a text file with your QR payload (for example mytext.txt).
2. Generate a QR code and store it as terminal output:

   qrencode -t ANSIUTF8 < mytext.txt > qr_payload.txt

3. Display the QR code in your terminal:

   cat qr_payload.txt

This method keeps the entire process on your Linux server, giving you full control over your backups while ensuring that nothing ever leaves your secure environment.

Embed payload in your own HTML

If you prefer not to use a QR code, you can also create a small HTML file that redirects to the Combine page with the payload already embedded in the URL. This file can be uploaded to your own webhosting. Anyone who visits the page will be redirected straight into combine.html with the data preloaded.

Below is a complete example of such a file (share.html). You can copy, paste, and save it. Replace the JSON inside the payload variable with your own share.

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <meta name="robots" content="noindex,nofollow">
  <title>Redirecting…</title>
  <script>
    const payload = encodeURIComponent('{"t":"s","c":"crypto","n":3,"k":2,"i":2,"id":"d8a851ae","d":"802f"}');
    window.location.replace("https://qrsafeshare.com/combine.html#" + payload);
  </script>
</head>
<body>
  <p>Redirecting to QR SafeShare…</p>
</body>
</html>

Place this file on your hosting and (optionally) link to it or write its URL onto an NFC tag. When someone opens the URL, their browser will load this file, which instantly forwards them to the Combine page with the embedded payload.

Security tip: it may be wise to protect this file or directory with a password (HTTP Basic Auth or similar), or use a time-limited/signed URL. This prevents anyone who finds the URL from immediately accessing the embedded payload.

Frequently Asked Questions