1. The Anatomy of an Ephemeral QR Session
When a customer scans a physical Pokodrop QR code, their camera decodes a URL pointing to the shop's unique upload endpoint.
Rather than requiring an account or OAuth login, the upload client executes entirely within the browser sandbox using standard HTML5 APIs:
- HTML5 File API: Reads binary file streams directly from device memory.
- Web Cryptography API (SubtleCrypto): Performs hardware-accelerated encryption directly on the mobile CPU.
- Secure Transport Layer: Sends encrypted chunks over TLS 1.3 to the storage infrastructure.
2. Step-by-Step Cryptographic Handshake
The customer browser generates a random 256-bit symmetric AES-GCM key per upload session.
The document is divided into encrypted binary blocks. Plaintext never leaves device memory.
A WebSocket or Server-Sent Event pushes the new session card to the shop operator's screen with file size and type previews.
3. Direct Browser Printing vs File Downloads
Traditional file drop platforms force the recipient to download the file to their hard drive before printing. Pokodrop introduces in-browser direct printing:
The shop operator's browser decrypts the stream in volatile RAM and triggers the native browser print dialogue (window.print() on an embedded blob). Once printed, the blob is revoked, leaving 0 bytes on the computer disk.
Want to see our security architecture in detail?
Read our full technical breakdown on key management, cipher suites, and data retention policies.