Plain mode is not encrypted. Anyone who scans the code can read the string.
Encrypted code
QR contents
Recover
URL fragment payload imported.
Waiting for payload.
Recovered string
Canvas display reduces casual DOM exposure. It does not protect against a compromised browser, OS, extension, screenshot, screen recorder, or keylogger.