Lessons from building a QR-paired browser handoff tool

Short summary

Engineer shares design lessons from building a QR-paired browser tool for ephemeral text/file transfer. Used ECDH+AES-GCM encryption in the browser, avoided public links to simplify the product model, and tested across real devices to handle platform-specific API constraints. Key insight: designing for narrow constraints (live pairing only, no accounts) simplifies the user mental model and reduces security surface area.

• •QR pairing keeps sessions ephemeral—both browsers must be present simultaneously, eliminating risks from link forwarding and long-lived shares
• •Browser-side ECDH+AES-GCM encryption ensures the routing service sees only connection metadata, never file contents or text
• •Real device testing revealed critical constraints: backgrounding, clipboard, file I/O behave differently across desktop Chrome, Android Firefox, and WebViews

Generated with AI, which can make mistakes.