Not just QR code, may be small enough secrets fit in a URL (2KB I think is the limit)! See also the now defunct sharelock.io by Auth0: https://news.ycombinator

Not just QR code, may be small enough secrets fit in a URL (2KB I think is the limit)! See also the now defunct sharelock.io by Auth0: https://news.ycombinator.com/item?id=9109924 https://news.ycombinator.com/item?id=9109924 For creating and later validating magic-links (using Web APIs), I encode the IV, Salt, Cipher all in the URL as a single base64 token: https://github.com/celzero/otp/blob/cddaaa03f12f765fa8da9178d94896cb72de3fbd/src/core/etm.js#L34 https://github.com/celzero/otp/blob/cddaaa03f12f765fa8da9178... (Btw, reading through your code makes me wonder if I should pad the plaintext to match blocksize despite https://archive.is/NX7Y2 https://archive.is/NX7Y2)?