The Complete SecurePaper Guide

What SecurePaper does in 30 seconds

You type sensitive text - passwords, a seed phrase, 2FA backup codes, emergency instructions. Your browser encrypts it with AES-256-GCM using the WebCrypto API, so the readable text never leaves your device. The encrypted result is rendered as QR codes you download or print. The paper is meaningless to anyone who finds it: without your encryption key or passphrase, it is just ciphertext.

To read it back, you scan the codes with any camera or upload a photo, and decrypt them in the browser with your key or passphrase. Paper survives dead hard drives, hacked cloud accounts, and forgotten subscriptions - and encryption makes it safe to leave lying around. The full technical details are on the security page.

Create your first SecurePaper

1. Open the create page

   Go to the create page. You do not need an account - encryption works exactly the same as a guest.

2. Optionally pick a template

   Templates pre-fill the form for the things people actually secure on paper: wallet seed phrase, 2FA backup codes, emergency access for family, banking details, and Wi-Fi & home codes. They are just a starting structure - edit anything, or skip them and start blank.

3. Choose your protection

   Pick between an encryption key (generated for you and saved in your browser or account) and a passphrase (something you remember; at least 8 characters, entered twice, and stored nowhere). Unsure which? See the comparison below. If you already have keys, you can also reuse an existing one so several papers share a key.

4. Type your content

   Give the paper an optional name and enter the text to secure. The name is printed in plain text on the PDF and used in file names, so keep secrets out of it. Below the text box a live counter shows the character count and an estimate of how many QR codes the encrypted output will need - roughly a hundred characters of text per code, since encryption adds overhead.

5. Generate

   Click Generate. Encryption runs locally in your browser; the readable text is never sent anywhere.

6. Download or print

   On the result page, Download saves all the codes as one PNG image, and Print builds an A4 PDF that also includes decryption instructions and the offline decryptor address - useful for whoever opens the envelope years from now. If you used a key, the page also shows the key as its own QR code that you can download or copy separately.

Key or passphrase?

Both protect your paper with AES-256-GCM. The difference is where the secret that unlocks it lives. In passphrase mode the key is derived from your passphrase with PBKDF2-SHA256 (600,000 iterations) every time you decrypt - nothing is stored anywhere.

Which one for your situation?

• Seed phrase you will rarely touch: passphrase. Nothing stored anywhere, decryptable decades later on any device. More in the seed phrase backup guide.
• Emergency access for family: passphrase - your family will not have your browser or account, but they can know or be told the passphrase. See emergency access.
• 2FA backup codes you may need anywhere: passphrase, or a key synced to an account. See 2FA backup codes.
• Passwords you refresh from your own computer: key - nothing to remember, and one key can cover many papers. See password backup.
• Team or business documents: keys with an account, so access does not depend on one person's browser. See SecurePaper for business.

Printing best practices

• Use the built-in Print (PDF) option. It lays the codes out on A4 at a size that scans reliably and adds decryption instructions to the page. If you print the PNG yourself, do not shrink the codes to save space - a code that is hard to scan on screen will be harder on paper.
• Test-scan before filing it away. Print, then scan the paper once at the decrypt page and confirm it decrypts. A backup you have never restored is a hope, not a backup.
• Prefer a laser printer. Toner is fused onto the paper and survives water. Inkjet ink smears when wet - if inkjet is all you have, laminate the page or keep it in a plastic sleeve.
• Print two copies and store them in different places. Paper's main enemies - fire, water, loss - rarely strike two locations at once.
• Laminate or sleeve the page, and avoid folding through the codes; a crease across a QR code can make it unreadable.
• Do not keep a digital copy "just in case". The codes are encrypted, but a QR image sitting in your camera roll or cloud drive is just a digital backup with extra steps - it reintroduces exactly the online exposure the paper avoids. Print, verify, then delete the file.

Where to keep the paper and the key

The whole point of encryption is that the paper and the secret that unlocks it can live apart. Separate them so that finding one is useless without the other.

Strategies that work

• Paper at home, key QR in your wallet. A burglar who finds the paper cannot read it; losing your wallet exposes nothing readable either.
• Paper in a bank vault, passphrase in your memory. The strongest separation: the physical copy is protected by the bank, and the secret is stored nowhere at all.
• Emergency envelope with a lawyer or trusted person. The sealed envelope holds the paper; the passphrase is communicated separately or already known to your family. Whoever holds the envelope cannot read it.

What not to do

• Do not tape or staple the key QR to the paper it unlocks - that is plaintext with extra steps.
• Do not store both copies, or the paper and the key, in the same drawer or the same building.
• Do not write the passphrase on the paper or on anything stored with it.
• Do not keep a photo of the key QR next to a photo of the paper in the same camera roll.

Getting your data back

Open the decrypt page on any device. There are three ways to get the code in:

• Camera scan. Point your camera at the printed code - capture is automatic, and you can switch between front and back cameras.
• Photo upload. Upload a photo or scan of the page. Multiple QR codes in one image are detected in a single pass, so one clear photo of the whole sheet is often enough.
• Paste the text. Every code has its text printed beneath it. If a code is damaged or you have no camera, type or paste that text instead.

Papers with multiple codes

Longer texts are split across several codes, each labeled with its position (the printed text starts with SP:1/3|, SP:2/3|, and so on). Scan every part - in any order; the page tracks which parts it has and combines them automatically once all are in.

Unlocking

If the paper is key-protected, any keys saved in your browser or account are tried automatically. Otherwise, scan the key's own QR code, upload an image of it, or paste the key manually. Passphrase-protected papers are recognized automatically and you are simply asked for the passphrase.

Key backups

A key-protected paper is only as durable as your access to the key. SecurePaper gives you three layers:

• Export a JSON backup. The dashboard has an Export button that downloads all your keys as a single securepaper-keys-backup JSON file. Store it on a USB stick or in another safe place. The matching Import button restores the keys in any browser later.
• Guests: exporting is not optional. Without an account, keys live only in this browser's local storage. Clearing site data, reinstalling the browser, or switching devices deletes them - and without the key, the paper cannot be decrypted. Export a backup (or download the key's QR code) before you rely on any paper.
• Accounts sync keys to the cloud. Convenient across devices and immune to cleared browser data - in exchange, your keys are stored with your account. That trade-off, and what it means in practice, is documented honestly on the security page.

Passphrase-protected papers have no key to back up - the passphrase in your memory is the backup.

If SecurePaper ever disappears

Your papers must not depend on our servers staying up - and they do not. Decryption happens entirely in the browser, and the data format is publicly documented on the security page, so any developer could rebuild a decryptor from the spec alone.

You do not have to wait for that, either: we publish a standalone offline decryptor - a single HTML file that decrypts SecurePaper codes in any modern browser with no internet connection and no servers involved.

Frequently asked questions