Payment · authentication · WIALOCK1 (PBKDF2 + AES-GCM, in-browser)

A note only the passphrase opens

The text is encrypted in your browser before it becomes a code. Whoever scans sees a locked card and needs the passphrase — a safe-deposit note, a recovery hint, a message for one person.

Make this code now →

Opens the generator with this type selected. Everything happens in your browser.

Round WIA Code shown as a locked-card example (text placeholder)
Rendered by the same engine as the generator. Point the WIA scanner at it — or a plain camera at the small booster QR in the middle.

This example carries plain text rather than a real locked card payload: WIA never renders real locked card contents on public pages, because that content belongs only on a code you print yourself.

What the code carries

A WIALOCK1 record: the ciphertext, a salt and a nonce. The key is derived from your passphrase with PBKDF2 (600,000 rounds) and the text is sealed with AES-GCM — all inside the browser; the passphrase and the plain text never leave your device.

WIALOCK1 (PBKDF2 + AES-GCM, in-browser)

What happens when it is scanned

  1. The scanner reads the locked record from the code — offline.
  2. It shows a locked card and asks for the passphrase.
  3. If the passphrase is right, the text appears on the phone; if not, nothing is revealed.

Why a WIA Code for this

A printed secret that is useless without the passphrase — unlike a plain text code.
No server holds the key or the text; there is nothing to breach on our side.
Room for a real note: an L grid holds well over a thousand bytes of ciphertext.

How much fits

Measured on the live engine (bytes of content, after error correction). The QR column is a standard QR code of the same printed size, for comparison.

GridWIA Code (bytes)Same-size QR (bytes)With booster QR
S · 64 modules · round23960—
M · 96 modules · round608151—
L · 128 modules · round11283221092

This page's example is 101 bytes. The booster QR is a small standard QR placed in the centre so phones without the WIA scanner still get somewhere useful — it leads to the web scanner, which then reads the full code.

Before you print it

Choose a passphrase you can remember or store separately: there is no reset. WIA does not render real locked cards on public pages; the example below is plain text.

Questions people ask

What if I forget the passphrase?
The text is gone. There is no recovery — that is what makes the card safe.
Can WIA read my note?
No. Encryption happens in the browser; nothing is uploaded. WIA also refuses to build public permalinks for locked cards.
How strong is it?
PBKDF2 with 600,000 rounds and AES-GCM. The weak point is a guessable passphrase — use a long one.
Can I unlock it without the WIA scanner?
The web scanner at wiacode.com unlocks it too — in the browser, offline once loaded.
Why is the example on this page plain text?
Because a real locked card belongs only on a code you print yourself. Public examples never contain real ciphertext.
Make this code now →All kinds of content →

Other kinds of content

A payment request the wallet understandsAll kinds of content →

WIA Code is a radial-symmetry 2D code. The content lives in the code; there is no server in between when it is scanned. Generated with the WIA Code engine · scannable · no account needed