Home Page » News » Tutorials » How to Transfer Encrypted Files Between Android Phones Using QR Codes (No Root)

Transfer Encrypted Files Between Android Devices Using QR Codes (No Root)

15 min read Learn a step‑by‑step method to securely move files between Android devices by encrypting them in Termux and sharing via QR codes—no root required. October 11, 2026 16:00

Why Use QR Codes for Encrypted File Transfer?

Transferring sensitive data over Bluetooth, Wi‑Fi, or cloud services can expose it to eavesdropping or accidental leaks. QR codes are a air‑gapped medium: the data never touches a network, and the visual nature makes it easy to verify that you are scanning the exact image you generated. By combining QR codes with strong AES‑256 encryption in Termux, you get a portable, offline method that works on any Android phone—even those that lack root access.

Before You Start

Device requirements: Android 7.0 (Nougat) or newer, at least 1 GB free storage, and a charged battery (≥50 %).
Software: Termux (from F-Droid or the Play Store), Termux:API (optional for clipboard integration), and a QR‑code scanner app that can copy raw text (e.g., “QR & Barcode Scanner”).
Network: No internet connection is needed after the initial package install, but you will need Wi‑Fi or mobile data to download Termux and its packages.
File size awareness: A standard QR code can hold up to ~2 KB of binary data. We will split larger files into multiple QR codes automatically.

If you are new to Termux, think of it as a lightweight Linux terminal that runs inside Android. All commands below are typed inside the Termux console.

Step 1 – Install Termux and Required Packages

Open the F-Droid app (recommended for the latest, ad‑free version) and search for Termux. Install it.
Launch Termux. The first launch will set up its environment – allow it to finish.
Update the package repository and install the tools we need:
```
pkg update && pkg upgrade -y
pkg install openssl qrencode coreutils -y
```
openssl provides the encryption utilities, qrencode creates QR images, and coreutils gives us split and cat.
(Optional) Install the API package if you want to copy the final decrypted file to the shared ~/storage/downloads folder automatically:
```
pkg install termux-api -y
```

After installation, grant Termux access to your shared storage so you can read the file you want to send and write the received one:

termux-setup-storage

You will be prompted to allow storage access – accept it.

Step 2 – Create a Strong Encryption Key Pair

We will use symmetric encryption (a single secret) because it is fast and easy for one‑off transfers. The secret will be a 32‑byte (256‑bit) random key stored in a file that you keep private on the sending device.

Generate a random key and save it as enc_key.bin:
```
openssl rand -out enc_key.bin 32
```
Export the same key in a human‑readable hex form for later verification (optional but handy):
```
xxd -p enc_key.bin > enc_key.hex
```
Copy enc_key.bin to a safe place (e.g., a password manager or a secure note). You will need the exact same file on the receiving device to decrypt.

Why keep the key separate? If the QR codes are intercepted, they contain only ciphertext. Without the key, the data remains unreadable.

Step 3 – Encrypt the File and Prepare It for QR Encoding

Assume the file you want to send is /sdcard/Download/secret.pdf. The workflow is:

Encrypt the file with AES‑256‑CBC.
Base64‑encode the ciphertext so it becomes plain‑text (QR codes handle text better than raw binary).
Split the Base64 string into 1800‑byte chunks (leaving room for QR error‑correction).

Encrypt:

openssl enc -aes-256-cbc -salt -in /sdcard/Download/secret.pdf \
  -out secret.enc -pass file:enc_key.bin

Base64‑encode:
```
base64 secret.enc > secret.b64
```
Split into manageable pieces (1800 bytes ≈ 1200 characters, safe for QR):
```
split -b 1800 secret.b64 part_
```
This creates files named part_aa, part_ab, … each containing a fragment of the encoded data.

At this point you have a series of part_?? files ready to be turned into QR images.

Step 4 – Generate QR Codes from the Chunks

We will use qrencode to create PNG images. The -l H flag selects the highest error‑correction level (30 % data recovery), which is useful when scanning from a phone screen.

Create a directory to hold the QR images:
```
mkdir qr_codes
```
Run a loop that converts each part_?? into a PNG:
```
for f in part_*; do
  qrencode -l H -t PNG -o qr_codes/${f}.png -r $f
done
```
The -r option tells qrencode to read the raw file content directly.
Check the qr_codes folder – you should see a series of PNG files named part_aa.png, part_ab.png, etc.

Now you have a visual set of QR codes that can be displayed on the sender’s screen, projected onto a wall, or saved and shared via any image‑friendly app. Because the data is encrypted, the QR codes themselves are safe to show publicly.

Step 5 – Scan the QR Codes on the Receiving Device

On the target phone, open your preferred QR‑code scanner. Make sure it can copy the raw text (most scanners do). Follow these steps:

Create an empty file to accumulate the fragments:
```
touch received.b64
```
For each QR code displayed on the sender’s screen, scan it and append the captured text to received.b64. In many scanners you can tap “Copy” after each scan; then in Termux run:
```
termux-clipboard-get >> received.b64
```
If your scanner writes directly to a file, you can skip the clipboard step.
Repeat until you have scanned all QR images. The order matters – scan them in the same alphabetical order as the file names (aa, ab, …). If you miss one, the final file will be corrupted.

When you finish, received.b64 should be roughly the same size as the original secret.b64 on the sender.

Step 6 – Reassemble and Decrypt the File

Now we reverse the preparation steps:

Base64‑decode the accumulated file back to binary ciphertext:
```
base64 -d received.b64 > received.enc
```
Decrypt using the same enc_key.bin you generated on the sender (copy it securely to the receiver first – e.g., via a QR code of the hex representation, or via a trusted USB‑OTG transfer):
```
openssl enc -d -aes-256-cbc -in received.enc -out decrypted.pdf \
  -pass file:enc_key.bin
```
Verify that the file opened correctly. If you have sha256sum on both devices, compare checksums:
```
sha256sum secret.pdf   # on sender
sha256sum decrypted.pdf # on receiver
```
Identical hashes confirm a successful transfer.

That’s it – you now have the original file on the receiving phone, never having exposed it to a network.

Alternative: Using a Single QR with Compression

If the file is small (< 1 KB after encryption), you can skip the chunking step and generate a single QR code:

openssl enc -aes-256-cbc -salt -in myfile.txt -out myfile.enc -pass file:enc_key.bin
base64 myfile.enc | qrencode -l H -t PNG -o single_qr.png

Scanning the single QR directly yields the Base64 string, which you can decode and decrypt as shown earlier.

Troubleshooting

QR code unreadable: Increase the error‑correction level to -l H (already used) and ensure the display is bright and the phone camera is steady. Reduce the chunk size to 1500 bytes if the scanner still fails.
Missing or out‑of‑order chunks: The decryption will fail with “bad decrypt”. Double‑check the scanning order. You can embed a simple index at the start of each chunk (e.g., 01|, 02|) and later sort the file before concatenation.
Incorrect key: OpenSSL will report “bad decrypt”. Verify that the enc_key.bin on the receiver matches the sender’s key (compare the hex dump). Remember that the key file is binary – copying it via a text‑only channel will corrupt it.
File too large for QR: Even with chunking, the number of QR images can become unwieldy. For files > 5 MB, consider using a local Wi‑Fi Direct or Bluetooth transfer instead. QR is best for small‑to‑medium confidential items (documents, passwords, small images).
Termux storage permission denied: Re‑run termux-setup-storage and accept the prompt. If the problem persists, uninstall and reinstall Termux.

Safety and Privacy Tips

Never reuse the same enc_key.bin for multiple transfers. Generate a fresh key each time to enforce forward secrecy.
Delete the key file from both devices after decryption if you do not need it again: shred -u enc_key.bin (install coreutils for shred).
Store the QR images only temporarily. If you keep them, anyone with a screenshot can attempt brute‑force attacks on the ciphertext.
Prefer a strong passphrase‑derived key (using openssl enc -pbkdf2) if you cannot safely transfer a binary key file.

Edge Cases and Advanced Options

Using a password instead of a binary key: Replace -pass file:enc_key.bin with -pass pass:YourStrongPassword. Remember that passwords are easier to guess, so use a high‑entropy phrase.
Automating the whole pipeline: Create a shell script qr‑send.sh that takes a file path, encrypts, splits, and generates QR images in one command. Likewise, a qr‑receive.sh can collect scanned chunks into a file and decrypt automatically.
Using external storage (SD card): Replace /sdcard/Download with the actual mount point (e.g., /storage/XXXX-XXXX). Ensure Termux has permission via termux-setup-storage.
Cross‑platform compatibility: The same QR‑code set can be scanned on iOS, Windows, or Linux devices as long as they run OpenSSL and can decode Base64. This makes the method useful for mixed‑OS environments.

Wrapping Up

By following the steps above you have created a completely offline, end‑to‑end encrypted file‑transfer workflow that leverages only free, open‑source tools available on any Android phone. The process is transparent: you control the encryption key, you see exactly what data is being encoded, and you avoid any third‑party cloud or network that could compromise privacy.

Feel free to adapt the script snippets to your own workflow – for example, integrating QR generation into a Termux shortcut or automating the scan‑append step with termux-camera-photo and zbarimg. The core idea remains the same: encrypt, encode, split, scan, reassemble, decrypt. With this knowledge you can securely exchange passwords, confidential PDFs, or any small file without ever touching the internet.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.