Avoid sending confidential user secrets to http://qrcode.kaywa.com by using the MIT-licensed https://github.com/davidshimjs/qrcodejs library for pure browser goodness.