This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
QR Crypt
Exchange keys in person. Encrypt text permanently offline.
No comment highlights available yet. Please check back later!
About QR Crypt on Product Hunt
“Exchange keys in person. Encrypt text permanently offline.”
QR Crypt was submitted on Product Hunt and earned 0 upvotes and 1 comments, placing #66 on the daily leaderboard. In-person key exchange. Encryption and decryption stay on permanently offline devices. Only ciphertext crosses the air gap, via QR codes.
QR Crypt was featured in Open Source (68.7k followers), Privacy (11.3k followers) and Security (2.8k followers) on Product Hunt. Together, these topics include over 28.5k products, making this a competitive space to launch in.
Who hunted QR Crypt?
QR Crypt was hunted by New User. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how QR Crypt stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
New User
Hey Product Hunt. I'm transparent-pegasus, and I built QR Crypt.
Why I built it
Mercenary spyware takes the whole device. A Pegasus-class implant reads your
keyboard, your screen, your camera, and your keys at rest, and no cipher saves
you from an attacker who watches you type. So I stopped trying to harden the
protocol and asked where the plaintext could live instead. The answer costs you
a second device that never connects to anything, with a camera as its only way in.
How it works
You keep one device offline from setup onward. You type there, the app encrypts,
and it draws the ciphertext on screen as a QR code. Your everyday phone scans
that code, and you paste the resulting text into whatever messenger you already
use. Your recipient works backward through the same steps. You swap public keys
face to face as QR codes, so no server ever holds them.
What the crypto is
AES-256-GCM by default. ML-KEM-1024 with HKDF-SHA256 when a message has to stay
secret for decades, and ML-DSA-87 when your recipient needs to verify who sent
it. I wrote none of these primitives.
On the quantum question, the loose version gets the facts wrong, so here is the
careful one. Grover buys an attacker a quadratic speedup against AES-256 and
leaves about 128 bits, so AES-256 holds. Shor breaks the asymmetric layer, and
the risk there is harvest-now-decrypt-later: someone records your ciphertext
today and opens it when the hardware arrives. The default mode gives an attacker
no asymmetric key agreement to target, because you pass the key over in person.
ML-KEM and ML-DSA cover what an in-person key misses.
What it does not do
An attacker who owns your OS, browser, or firmware defeats it. So does a
keylogger, a screen recorder, malware that reads your camera, or a thief who
pockets the device. The offline indicator reports your current network state and
nothing beyond that. wipe-on-online deletes at the logical level, which on flash
storage leaves your data recoverable. Nobody has audited the post-quantum
suites, so treat them as experimental.
The repo carries the full threat model, both QR protocol versions, and the boot
and wipe contract. Tell me where the design breaks.