Not just QR code, may be small enough secrets fit in a URL (2KB I think is the limit)!

See also the now defunct sharelock.io by Auth0: https://news.ycombinator.com/item?id=9109924

For creating and later validating magic-links (using Web APIs), I encode the IV, Salt, Cipher all in the URL as a single base64 token: https://github.com/celzero/otp/blob/cddaaa03f12f765fa8da9178...

(Btw, reading through your code makes me wonder if I should pad the plaintext to match blocksize despite https://archive.is/NX7Y2)?