Zero-Knowledge Architecture
«Zero knowledge» means that the operator of this service structurally has no access to your encrypted content — even if they wanted to. All cryptography runs in your browser via the Web Crypto API, a W3C standard built into all modern browsers.
Your plaintext and your password are never transmitted to our servers. The server only delivers the HTML/CSS/JS files — after that, everything works locally.
Cryptographic Specification
The ISQR1 format is precisely defined to allow independent implementations to remain compatible:
| Parameter | Value | Rationale |
|---|---|---|
| Format-Prefix | ISQR1 | Versioning for future migrations |
| Cipher | AES-GCM 256-bit | NIST standard, authenticated encryption |
| KDF | PBKDF2-SHA-256 | Brute-force protection for weak passwords |
| Iterationen | 250 000 | OWASP recommendation 2024 (≥ 210,000) |
| Salt | 16 Byte (128 bit) | Random per encryption, prevents rainbow tables |
| IV / Nonce | 12 Byte (96 bit) | GCM optimal size for nonce uniqueness |
| Auth-Tag | 128 bit | Integrity protection, Web Crypto standard |
| Encoding | Base64url | URL-safe, compact, no + or / |
The complete payload format: ISQR1:<salt_b64u>:<iv_b64u>:<ciphertext_b64u>
Use Cases
-
Share WiFi Password
Guests scan the QR on your notice board. Only with the password (which you tell them verbally) can they see the WiFi credential.
-
Transfer Access Credentials
Safe code, key number, or system password — protected on paper without writing it in plaintext.
-
Emergency Information
Carry an encrypted medication list or emergency contacts in your wallet. The password is held by your doctor.
-
Business Cards
Make private contact details (e.g. personal mobile number) accessible only to selected people.
-
Secure Notes
Attach short encrypted memory aids to physical documents.
-
Password Sharing
One-time sharing of access credentials — safer than plaintext via email or SMS.
Regular QR Code vs. Encrypted QR Code
| Property | Regular QR Code | ISQR1 (encrypted) |
|---|---|---|
| Content readable without app | Yes, immediately | No, password required |
| Privacy | None | AES-256-GCM |
| Any QR scanner usable | Yes | Yes (Decrypt Link) |
| Offline capable | Yes | After first load |
| Integrity verifiable | No | Yes (GCM Auth-Tag) |
| Server dependency | None | None (crypto local) |
Frequently Asked Questions
How secure is the encryption?
We use AES-GCM with 256-bit keys — the same standard used by banks and governments worldwide. The key is derived via PBKDF2 with 250,000 iterations and a random salt. A weak password is the only weak point — we recommend at least 12 characters with numbers and special characters.
Can istyle.ch read my content?
Structurally no. The encryption runs entirely in your browser via the Web Crypto API. Neither the plaintext nor the password are ever transmitted to our servers. That is the zero-knowledge principle: even if we wanted to, we could not read anything.
What happens if I forget my password?
The content cannot be decrypted without the correct password — not even by us. There is no password recovery and no master key. Please store the password safely, e.g. in a password manager.
What data is stored?
None. We store neither your content, nor the password, nor the generated QR code on our servers. There is no database, no content logs, no cookies, and no tracking scripts on tool pages.
Does the tool work offline?
An internet connection is required to load the page initially. Since the cryptography runs entirely in the browser, you can then use the page from the browser cache and encrypt and decrypt without a connection.
How large can the encrypted text be?
The tool supports up to 1,500 characters of plaintext. QR codes have a maximum data capacity (Version 40, approx. 3 kB), and with Base64 encoding and ISQR1 overhead this practical limit applies. Longer texts lead to very dense QR codes that can no longer be reliably scanned.
Can any QR scanner read the code?
Yes — any standard QR scanner can scan the code. In Decrypt Link format, the scan automatically opens this website where the password can be entered. In the raw format, you see only the ciphertext string, which must then be pasted manually on this page.
What does zero-knowledge mean?
Zero-knowledge means the service operator structurally has no way to access plaintext data — not because they promise it, but because the system is built so that it is technically impossible. Decryption happens locally; the key never leaves your browser.
Which browsers are supported?
All modern browsers: Chrome 90+, Firefox 90+, Safari 15+, Edge 90+, Opera 76+. The Web Crypto API is a W3C standard implemented in all current browsers. Internet Explorer is not supported.
Can I use special characters, umlauts, and emoji?
Yes. The system uses UTF-8 encoding internally, so the entire Unicode character set is supported — including umlauts (ä, ö, ü, ß), accents, Chinese characters, Arabic script, and emoji.
Is the source code viewable?
The JavaScript crypto code is at /assets/js/crypto.js and directly viewable in the browser (not minified). The Web Crypto API is an open W3C standard, fully documented at developer.mozilla.org and independently auditable.
What distinguishes ISQR1 from other formats?
The ISQR1 prefix enables versioning: if a future standard ISQR2 becomes necessary (e.g. for a stronger KDF), decoders can support both formats in parallel. The format contains salt and IV directly in the payload — no external storage needed.