Step by step
How QR photo sharing works
FotoQR is a shared gallery for event photos. Create one in a minute, show the QR code at a wedding, celebration, christening or company event, and guests upload directly from their phones without an app or an account. Every photo is encrypted in their browser, so only unreadable data reaches the server.
The gallery journey
QR photo sharing in five steps
Step 1
Create a gallery
Enter the event name and your email. Your browser generates a random gallery encryption key and adds it to your private link after #. You get 50 photos and 7 days with no payment card required.
- Save the private link immediately: it is your entrance to the gallery.
- With an account password, the key is backed up automatically so you don't lose it.
Step 2
Share the QR code
Every gallery comes with a QR code and a print-ready PDF with your own text above and below the code. Put it on a table, project it on a screen or send it in a group message.
- The QR code contains the full link and key: show it only to people at the event.
- A paid expansion adds a gallery password as an extra access check.
Step 3
Guests upload photos
Scanning opens a regular web page: no app, no account. Guests select photos on their phones. The browser prepares thumbnails and display copies, encrypts them and only then uploads them.
- Works on iPhone and Android: all you need is a browser.
- With full quality enabled, the original is encrypted too; a paid expansion unlocks its download and videos.
Step 4
You stay in control
In gallery management, turn uploads or viewing off at any time, delete photos, enable moderation for new uploads and track how much capacity is used.
- Moderation: others see new photos only after your approval.
- Paid features: passwords, guest downloads, videos, full quality and ZIP.
Step 5
Take your photos with you
Download individual photos or the complete ZIP archive. Files are decrypted and the archive is built in your browser, so the server cannot see content even during downloads. A purchase can extend gallery validity.
- When validity expires, the gallery and its data are automatically deleted.
- ZIP and full-quality originals are paid features.
A photo's journey
Where photos are encrypted and opened again
1. Guest's phone
The photo is still readable here.
- the browser takes the key from the link after #
- encrypts the photo and thumbnail (AES-GCM)
2. FotoQR server
The photo is unreadable here.
- stores a .bin file and nonce
- knows the size, dimensions and time
- has no key, so cannot open the content
3. Browser with the link
The photo is reconstructed.
- the same key from the link after #
- decrypts and displays the photo
The key never leaves the device. Browsers never send the part of a link after # to the server. Only people you show the link or QR code to have it.
Demo
Try it with one photo
The buttons below run the same encryption FotoQR uses for uploads. Everything happens in your browser and nothing is sent.
In your browser
The photo is only here for now, unencrypted.
What the server receives
Nothing has been sent yet.
Start by clicking “Encrypt photo”.
Your browser does not offer the Web Crypto API, so this demo cannot run here. The principle is the same: encryption happens on your device and the server receives only binary data.
Private link
Why the part after # matters
The server receives
https://qrshared.com/g/summer-party
This part tells the server which encrypted files to send. It knows the gallery name and settings, but not the photo content.
The server does not receive
#k=G7xT2p...pQ
After the # is the encryption key itself. Browsers do not send this part of the address to the server; only the page code on your device uses it.
Transparency
What the operator can and cannot see
Can see
- the organiser's email, gallery name, settings and limits,
- encrypted photos, thumbnails and any originals,
- technical details: size, dimensions, upload time and nonce values,
- the original filename when an original is stored,
- operational logs, such as an IP address hash.
Cannot see
- photos in readable form,
- the gallery encryption key in readable form,
- the ZIP archive, which is created only in the browser,
- the account password in readable form,
- what or who is in a photo.
What if
Frequently asked questions about QR photo sharing
I lose the private link+
If you have neither the link, QR code nor an account key backup, the photos remain encrypted forever. FotoQR has no back door: that is the cost of keeping content hidden even from the operator. Save the link and QR PDF as soon as you create the gallery.
I want protection against losing the key+
Set an account password. Your browser creates an account key pair: the public key locks backups, and your password locks the private key. Each new gallery is then backed up automatically at creation, without entering the password. The server stores only the locked backup, unreadable even to us without your password.
Someone uploads a photo I don't want+
You can delete it. To prevent surprises, enable moderation so new photos appear to others only after approval. You can turn uploads off completely at any time.
Gallery password versus encryption key+
Gallery and upload passwords are paid guest access checks, like a gatekeeper. Actual encryption relies on the key in the link; a password does not replace it.
What happens after expiry+
The gallery and encrypted files are automatically deleted. We send an email warning before expiry. To continue, buy an extension; download your photos in the meantime.
Why the server knows dimensions and size at all+
These are technical details sent by the browser to lay out the gallery grid, enforce limits and prepare downloads. They are not image data and cannot reveal the photo's content.
The best way to understand it is to try it
Create a test gallery and try it for yourself.
Your first 50 photos are free, with no payment card required. The key stays in your private link.