Temporary codes, QR links and Pase security

A Pase uses six characters displayed in two groups, for example ABC-234. The code lets the second browser reach the connection state associated with the first. It is not an account, a reusable password, a permanent address or a file identifier. After the Pase ends, the code cannot recover anything that was sent because there is no stored content inbox.

Treat it as a temporary invitation. Someone who obtains it during its useful window can attempt to join. A Pase admits the owner and one second participant; if another participant is pending or connected, the server rejects additional joins. Even so, putting the code into a public room or exposed screenshot creates unnecessary risk.

The alphabet contains selected uppercase letters and digits, 31 symbols in total. It excludes I, L, O, 0 and 1 to reduce reading mistakes. The Worker uses crypto.getRandomValues where available and applies rejection sampling: bytes that would create an uneven symbol distribution are discarded before a value is mapped to the alphabet.

That design avoids obvious patterns and simple distribution bias, but a short code is still intended for a brief session, not to protect a file for months. Protection combines randomness, a short window, a two-participant limit and rate controls on creation and joining endpoints. Calling the code an encryption password would overstate its role.

The QR represents the join URL built by the application, with the code in its code query parameter. Scanning saves typing but does not create a different security layer. A photograph of the QR is, during the Pase lifetime, a copy of the join link. It should not appear in a stream, recorded video call or public screenshot.

Before opening a QR received away from your own screen, verify that the host is mandamele.com and that production uses HTTPS. A QR can point anywhere; its visual pattern does not prove legitimacy. The application validates code format, but the user still needs to check the destination being opened.

A newly created anonymous Pase has ten minutes to establish the connection. If no browser joins, the state expires. After connecting, an anonymous session closes after thirty minutes without activity. The client sends periodic pings while connected, and signalling also refreshes technical activity.

Closing the tab, selecting close or losing connectivity can end the Pase for the other browser. Expiry limits the future usefulness of the code, but it cannot delete a QR screenshot or a download already saved by the receiver. These timings protect session state; they are not a remote deletion mechanism.

The shared protocol supports participant requests, approval and rejection. During this QA pass, REQUIRE_PASE_APPROVAL is disabled: the owner browser automatically approves a valid request to preserve the current flow without an extra screen. It is therefore particularly important to give the code only to the intended person or device.

Once connected, WebRTC control events are forwarded only between the two identifiers approved in the Pase state. Messages with invalid targets are rejected. This protects control routing, but it is not human identity verification. When strong certainty about the other endpoint matters, confirm through a second channel before sending.

Create the Pase when both devices are ready, show the QR directly or send the code through a private channel, and close the session when finished. Avoid reusing old screenshots even though the code will probably have expired; screenshots may reveal context around the transfer. If a connection is unexpected, close the Pase and create a new one instead of continuing.

For sensitive files, confirm the recipient, check that no unexpected device joined and consider encrypting the file first. Afterwards, verify the downloaded copy and remove extras. Useful security depends on more than the code: it includes the device state, privacy of the channel carrying the invitation, and handling of the file after receipt. Prefer a fresh code whenever either person is unsure how widely an earlier link was exposed.