Hardware wallets secure the signing process but leave the backup completely exposed.

Paranoid Qrypto encrypts the backup BEFORE it ever touches physical media.

🔑 Key Derivation: Argon2id

• Winner of the Password Hashing Competition (2015)
• Resistant to GPU, ASIC, and side-channel attacks
• Configurable difficulty levels: 3 (Essential), 5 (Advanced), 7 (Ultimate)
• Memory-hard function: expensive to parallelize on specialized hardware

🔐 Encryption: AES-256-GCM

• NIST-approved symmetric encryption
• 256-bit key length (quantum-resistant in near term)
• GCM mode provides authenticated encryption (integrity + confidentiality)
• Used by governments, banks, and security agencies worldwide

🛡️ 2FA: TOTP (RFC 6238) — Advanced & Ultimate

• Time-based One-Time Passwords
• Industry standard (same as Google Authenticator, Authy)
• Works offline—no network required
• 30-second rolling codes

🔀 Shamir's Secret Sharing — Ultimate

• Split your encrypted QR into M-of-N shares
• Mathematical guarantee: need threshold number of shares to reconstruct
• Even fewer shares reveal ZERO information

Essential at $99 already provides stronger backup security than ANY hardware wallet or password manager on the market. Higher tiers add convenience and additional layers, but Essential alone beats every traditional solution.

You will NEVER be stuck waiting for Paranoid Qrypto to "support" a new asset. If it can be written as text, it can be encrypted.

...is UNIQUE IN THE MARKET.

Step 1: Find Your Device

Take any old smartphone or laptop that you no longer use for daily tasks.

Step 2: Create the Air-Gap

Perform a factory reset and ensure it never connects to the internet, Wi-Fi, or Bluetooth again. This is now your permanently offline air-gapped signing device.

Step 3: Install Paranoid Qrypto

Transfer the application file to the device via a trusted SD card or USB data device.

Step 4: Create Your Indestructible Backup

Encrypt your seed phrase/password/any text up to ~2100 characters into a QR code and transfer it out via SD card to be engraved on metal or printed on paper.

Step 5: Sign Transactions Securely

Use your air-gapped device with a compatible wallet app to sign transactions by scanning QR codes. Your private keys never touch an online machine.

Step 6: Store or Destroy

For maximum security, you can power down and store your signing device in a safe place, or delete/format/destroy it, knowing you can always recreate it on another device using your indestructible QR code backup.

What It Does

• Fetches XRP account info (online)
• Generates QR codes for unsigned transactions
• Regenerates QR codes from transaction JSON
• Submits signed transactions (online)

What It Does

• Fetches UTXOs from blockchain (online)
• Fetches fee estimates (online)
• Generates QR codes for unsigned transactions
• Regenerates QR codes from transaction data
• Submits raw hex transactions (online)

What It Does

• Fetches nonce from Etherscan (online)
• Fetches gas fees from Etherscan (online)
• Calculates transaction costs
• Generates QR codes for unsigned transactions
• Submits raw hex transactions (online)

What It Does

• Side-by-side text/code comparison with diff highlighting
• Calculates MD5, SHA-256, SHA-512 hashes
• Verifies file hashes against expected values

PRIVACY RATING: 10/10 — Zero dependencies means zero attack surface.

"Closed Source" Concern

The comparison is NOT:

Paranoid Qrypto (closed source) vs. Ideal open-source solution

The comparison IS:

Paranoid Qrypto (encrypted, possibly imperfect) vs. Hardware wallet backup (plaintext, ZERO protection)

Even in the worst-case scenario where the implementation has some flaw:

• Encrypted with a potential flaw is STILL BETTER than plaintext with no protection
• A thief needs to break encryption vs. simply reading words on paper

"No Third-Party Audit" Concern

• Audits can miss vulnerabilities
• Audits are snapshots in time (code can change after)
• Auditors can be compromised or bought
• Many "audited" products have still been hacked
• The attack surface is minimal by design (offline, zero-knowledge, no accounts)

The most valuable audit is one you can do yourself:

1. Verify offline operation
2. Verify checksums
3. Verify standard cryptography
4. Test decryption with known inputs

"Small Team" Concern

This is actually a feature, not a bug. Paranoid Qrypto is designed for vendor independence:

• The software works offline forever
• No subscription required
• No servers to shut down
• No account to disable
• No firmware updates needed for new cryptocurrencies

Once you buy it, it's yours. The company could disappear tomorrow and your encrypted backups remain accessible.

"Version Lock-In" Concern

This is by design for security reasons. Workaround exists:

1. Decrypt your existing backup with your current version
2. Re-encrypt with the new version
3. Create new metal backup if needed

If you lose your password + pepper + 2FA:

→ You have "shot yourself" — access is permanently lost

→ This is not a bug, a flaw, or an oversight

→ This is the security model: zero trust, zero recovery, zero backdoors

Traditional Approach

Paranoid Qrypto Approach

Journalist in Authoritarian Regime

Family Estate Planning

Startup Founder

Physical Decay

Magnetic, optical, and flash storage all degrade with age. The physical materials that store your data don't last forever.

Charge Leakage

Flash memory (USB, SD cards, SSDs) stores data as electrical charges, which slowly dissipate over time. This is why flash drives left in a drawer for years may lose data.

Magnetic Degradation

The magnetic orientation of grains on HDDs can flip spontaneously due to thermal fluctuations, corrupting data.

Dye Degradation & Oxidation

The organic dyes in CDs/DVDs/Blu-rays can break down, especially when exposed to light, heat, or humidity.

Testing Offline Operation

1. Disconnect device from all networks (Wi-Fi, cellular, Ethernet)
2. Run Paranoid Qrypto
3. Perform encryption and decryption
4. Observe that all functions work without network
5. Optional: Use network monitoring software to confirm zero connections

Testing Checksum Verification

1. Download Paranoid Qrypto
2. Note the provided checksum (SHA-256)
3. Calculate checksum of downloaded file:
   • Windows: CertUtil -hashfile filename SHA256
   • Mac: shasum -a 256 filename
   • Linux: sha256sum filename
4. Compare calculated hash with provided hash

Testing Multi-Layer Security

1. Encrypt a test message with password + pepper (Essential)
2. Try to decrypt with only password → Should fail
3. Try to decrypt with only pepper → Should fail
4. Decrypt with password + pepper → Should succeed
5. For Advanced/Ultimate: Repeat with 2FA requirement

This fusion is the solution to the paranoid philosophy:

• Cryptography provides the security (zero-knowledge encryption)
• QR Code provides the physical resilience (offline, durable format)

🛡️ TRUST SHOULD BE OPTIONAL

We don't ask you to trust us. We ask you to trust yourself.

• No account required
• No email collected
• No cloud storage
• No backdoors
• Zero-knowledge by design

🔥 SURVIVAL FIRST

If your security solution can't survive a house fire, loss of hardware, an EMP, a firmware update, or vendor bankruptcy...it's decoration, not security.

👑 YOU ARE THE SOVEREIGN

No passwords sent to servers. No recovery keys held hostage. No "convenience" backdoors. True ownership means you're the admin, custodian, and fallback.

🤝 ZERO TRUST

Including ourselves: No data collection. 100% Offline. No recovery backdoors.

If we can't access your data, neither can anyone else.

The alternative to Paranoid Qrypto is not "a better encryption tool."

The alternative is PLAINTEXT.

Every hardware wallet, every metal backup product, every bank safe deposit box assumes you'll store your seed phrase or private key in plaintext. That's zero protection.

Paranoid Qrypto encrypts before physical storage. Even the entry-level Essential tier with just two security layers provides INFINITELY MORE PROTECTION THAN PLAINTEXT.

For anyone storing cryptocurrency seed phrases, private keys, or any sensitive text data physically—Paranoid Qrypto represents the best available solution at any price point.

If you can't trust yourself to manage credentials, Paranoid Qrypto isn't for you.

If you can, there's no better solution for physically storing encrypted secrets.

Our Position:

This is a valid concern that deserves a straightforward answer:

1. Business Model Reality: Nobody expects Photoshop, Microsoft Office, or Final Cut Pro to be free and open source. Paranoid Qrypto is a commercial product developed by a dedicated team. The core application represents years of development work and is our primary revenue source. Full open sourcing would make sustainable development difficult.
2. What IS Open Source:
   • XRP Airgap Bridge (offline transaction signing for XRP)
   • BTC Airgap Bridge (offline transaction signing for Bitcoin)
   • ETH Airgap Bridge (offline transaction signing for Ethereum)
   • Integrity Auditor Tool (verify file integrity with SHA-256)

   These tools handle operations transaction, signing and verification and are fully auditable.

3. Verification Options Available:
   • SHA-256 checksums are provided for every download, allowing you to verify file integrity
   • Network monitoring can confirm the app never makes outbound connections (it's truly offline)
   • Behavioral testing: You can verify encryption/decryption works as claimed through extensive testing
   • File analysis: The encrypted output can be examined to confirm AES-256-GCM structure
4. The Offline Advantage: Unlike cloud services where code runs on someone else's server, Paranoid Qrypto runs entirely on YOUR device. You control the execution environment. You can:
   • Run it on an airgapped device you control completely
   • Monitor all system calls if you're technically inclined
   • Verify no data leaves your device (because it never connects)
   • With the Paranoid protocol you can, offline encrypt verify, print/engrave, and physically destroy the device to ensure that the device does not contain any residue data.

Bottom Line: The closed source criticism is legitimate. We mitigate this through verifiable offline operation, open source auxiliary tools, and transparent cryptographic claims. The question each user must answer: Does the airgapped, offline nature of the tool reduce your risk enough to offset the inability to personally audit the code?

Our Position:

1. Audits Don't Guarantee Anything: Security audits can be bought. Many "audited" products have still been compromised. An audit is a point in time assessment, not an ongoing guarantee. Ledger had a data breach. Various exchanges have been hacked. Audits provide assurance but don't guarantee ongoing security.
2. Offline Design Is Better: The offline nature means YOU control the environment entirely. We don't even know your QR codes exist. This is fundamentally different from a cloud service where you must trust their infrastructure:
   • You choose the device
   • You choose the operating system
   • You control all network access
   • You can inspect all file outputs
   • You can run any monitoring tools you want
   • And once again to remind you: With the Paranoid protocol you can, offline encrypt verify, print/engrave, and physically destroy the device to ensure that the device does not contain any residue data.
3. What We Do Instead:
   • Published cryptographic specifications: We use standard, battle tested algorithms (Argon2id, AES-256-GCM, TOTP) with documented parameters
   • Test vectors: Advanced users can verify encryption/decryption with known inputs
   • Opensource components: The cryptographic libraries we use are industry standard and audited
   • Offline design: The attack surface is dramatically reduced by airgapped operation

Bottom Line: We acknowledge the lack of audit is a limitation. But the offline, airgapped design substantially reduces the attack surface compared to any connected product. For users whose threat model includes statelevel actors or sophisticated hackers, the inability to personally audit the code may be a dealbreaker. For users seeking protection from common threats (theft, phishing, cloud breaches), the current offering provides meaningful security.

Our Position:

1. SECURITY FEATURE, Not Arbitrary: Each tier uses different cryptographic parameters:
   • Essential: Argon2id Level 3, 2-layer security (password + pepper)
   • Advanced: Argon2id Level 5, 3-layer security (password + pepper + 2FA)
   • Ultimate: Argon2id Level 7, 3+ layers, includes Shamir's Secret Sharing

   These aren't just "features" they fundamentally change how encryption works. Different crypto parameters per tier means migration requires ReEncryption. A file encrypted with 2FA protection cannot be decrypted without 2FA, period.

2. Migration Path: Upgrading is straightforward:
   • Decrypt your data with your current tier
   • ReEncrypt with your new tier
   • Test thoroughly before destroying old backups

   This is a one time process that takes minutes for most users.

3. The Trade-Off: We could have designed a universal format that supports all tiers, but this would require:
   • Storing metadata about which encryption method was used (security risk)
   • More complex code with more attack surface
   • Potential for downgrade attacks

   We chose security over convenience.

Bottom Line: Version lockIn is a real limitation that stems from our security first design philosophy. We believe the tradeoff is justified, but users should be aware and plan accordingly.

Our Position:

1. TOTAL Privacy Benefit: No credit card = no personal information collected. No name, no address, no billing history, no email, no contact info. Just username + XRP address. For a privacy focused product, this aligns with our values perfectly.
2. Business Simplicity: Supporting multiple payment methods requires:
   • KYC compliance with fiat processors
   • Multiple crypto wallet integrations
   • Additional security and compliance overhead

   We prioritize product development over payment infrastructure complexity.

3. XRP Specifically: XRP offers:
   • Fast transactions (3-5 seconds)
   • Low fees (fractions of a cent)
   • Widely available on most exchanges

   Getting XRP is straightforward: purchase on any major exchange (Kraken, Coinbase, Binance, etc.) and send to the payment address.

Bottom Line: XRP only payment creates friction but protects both us and our users. The 5 minute process of acquiring XRP is a small price to pay for the privacy of having no payment records tied to your identity.

Our Position:

1. The Math IS Correct: With proper password and pepper selection:
   • Password (16+ chars mixed): ~10²⁰ combinations minimum
   • Pepper (32+ chars mixed): ~10⁴⁰ combinations minimum
   • Combined: ~10⁶⁰+ combinations

   The "8.4 × 10⁹⁴" figure represents the maximum theoretical combinations with optimal input.

2. We ENFORCE Strong Credentials: Unlike most services that accept "password123", Paranoid Qrypto enforces mandatory requirements:
   • Password: Minimum 16 characters, MUST include uppercase, lowercase, number, and special character (aA1!)
   • Pepper: Minimum 32 characters, MUST include uppercase, lowercase, number, and special character (aA1!)

   We apologize that we enforce these requirements, but this is best practice. This is MORE than most if not every other service enforces. Even with less than optimal password choices, our enforcement ensures stronger credentials than what most platforms accept.

3. The Swiss Cheese Model: Multiple layers protect you. If one layer fails, others still protect you:
   • Strong password (your knowledge)
   • Strong pepper (your second knowledge factor)
   • Optional 2FA (your possession factor)
   • Optional Shamir's Secret Sharing (distribution factor)
   • Physical storage security (your environment)
4. The Comparison That Matters:

   Put your cryptocurrency seed phrase in a safe. What protection does it have? ZERO. It's plaintext.

   Now encrypt it with Paranoid Qrypto FIRST, then put it in a safe. The safe opens but they still need your password, pepper, and optionally 2FA.

   That's the difference between ZERO protection and meaningful encryption.

5. What We DON'T Claim:
   • We don't claim "unhackable" (nothing is)
   • We do not claim to provide protection against physical threats because we have no control over real world violence or the use of torture to coerce a person to reveal decryption data.
   • We don't claim immunity to user error

   We claim that with proper usage, the encryption provides meaningful protection against realistic threats.

Bottom Line: Our marketing claims are mathematically accurate for optimal inputs. We acknowledge user responsibility, we can't force strong passwords any more than a lock manufacturer can force good keys. But unlike most services, we enforce minimum standards. The security is real but it requires user responsibility.

Our Position:

1. We're a New Product: Paranoid Qrypto is a new product. Community takes time to build. The market is rigged toward VC-backed companies with massive marketing budgets with a government agenda to sell you imaginary security like most Hardware wallets, we don't have that.
2. Our Target Audience: Our users tend to be:
   • Privacy conscious individuals who don't post about their security tools publicly
   • People who found us through targeted searches, not viral marketing although we welcome any opportunity
   • Users who value function over social proof

   This naturally limits public discussion.

3. Building Trust: We're actively:
   • Engaging with security communities
   • Responding to inquiries and criticism
   • Documenting our methods thoroughly
   • Being transparent about limitations (like this document)

Bottom Line: Limited community presence is a fair concern. We're working on it. But limited community ≠ bad product. Many excellent tools fly under the radar until they gain critical mass.

Our Position:

1. The Character Limit: Yes, ~2,100 characters is the practical limit for a scannable QR code. This covers:
   • All seed phrases (12, 18, or 24 words)
   • Most private keys
   • Recovery codes
   • Master passwords
   • API keys

   For longer content: SPLIT IT INTO MULTIPLE QR CODES.

   There is NO limit. You can make unlimited QR codes. You could encrypt an entire book, just split it across many QR codes. Impractical? Sure. Possible? Absolutely.

2. Error Correction: QR codes have builtin error correction which the system automatically uses and users don't need to configure this manually.
3. Best Practices for Metal Engraving:
   • Use high contrast materials
   • Test before relying on any backup
   • Make multiple copies as redundancy
4. Scanner Compatibility:
   • Use the built in QR Code scanner/regenerator
   • Adequate lighting when scanning
   • Clean, undamaged QR surface
   • Steady hands or tripod for difficult scans
   • Ensure QR Code is clean and sharp picture i.e. not blurry.
5. Redundancy: This is why we advocate for:
   • Multiple backup copies
   • Multiple storage locations
   • Periodic verification scanning (this is more of a practice suggesting to have the process memorized.)
   • Paper backup as additional redundancy

Bottom Line: QR code limitations are real but manageable with proper technique. The 2,100-character limit covers most use cases, and metal engraving durability far exceeds paper or electronic storage when done correctly.

What We Promise

1. We will never claim to be perfect or unhackable
2. We will always be honest about our limitations
3. We will protect user privacy above all else

What We Ask From You

1. Evaluate whether our tool fits YOUR threat model
2. Test thoroughly before relying on any backup
3. Follow best practices for passwords and physical security
4. Share your experience (positive or negative) with others