From plaintext to QR payload
The entered plaintext and password are used to produce an AES-encrypted payload. That payload, rather than the plaintext, becomes the QR code's data. The QR image therefore acts as a transport container for ciphertext; it does not perform decryption itself. Scanning recovers the embedded payload, after which compatible password-based decryption is still required.