QRCodebeta

QRCode completes the auth package's zero-dependency 2FA story. Instead of wiring an external QR library into TwoFactorManager's qr snippet, hand the otpauth:// enrolment URI straight to <QRCode> — an authenticator app (Google Authenticator, 1Password, …) scans it to register the shared TOTP secret.

Use errorCorrection="H" here: the extra recovery data keeps the code readable when it is scanned at an angle or from a distance across a second device. And never echo the secret into aria-label — the visible code already carries it, while the label is announced aloud and surfaced in the accessibility tree.

The encoder picks the smallest QR version (1–40) that fits and the most efficient mode for your data — numeric, alphanumeric, or UTF-8 byte — automatically. You never choose a version by hand.

Bound the size with maxVersion when a code has to stay physically small. Data that overflows that bound triggers onError and renders a visible fallback instead of throwing through the render, so the surrounding page stays up. Try it below: type past the maxVersion=4 capacity and the code swaps to its fallback.

• Renders as role="img" with an aria-label — defaulting to a localized "QR code" and overridable per instance.
• Never echo sensitive payloads (a 2FA secret, a signed token) into aria-label: it is announced aloud and exposed in the accessibility tree.
• For guaranteed scannability keep high-contrast dark-on-light modules. frame="card" supplies the light ground; the default foreground is currentColor, so an unframed code inherits the surrounding text colour.
• When encoding fails, the visible fallback also carries role="img" with the same label, so assistive tech is never left with an empty region.