Pack it on your Mac.
Pick it up with your phone.

1. When you choose Share via QR Code, Pickup starts a small web server on your Mac. It listens on a random port of the Mac's local network address only. For this share, Pickup makes a new key pair and a random 128-bit secret.
2. The QR code holds a link like http://192.168.1.20:52814/#…. The part after # carries the secret and the fingerprint of the Mac's key. A browser never sends this part over the network; it stays on the phone.
3. The phone loads the page from the Mac and opens a direct WebRTC connection to it. There is no server in between and no internet involved. The connection is encrypted with DTLS.
4. Before it trusts the connection, the page checks that the Mac's key matches the fingerprint from the QR code. So the phone knows it talks to your Mac and not to another device.
5. Only then the phone sends the secret, inside the encrypted connection. The Mac compares it. A device without the secret gets nothing and is disconnected after 15 seconds.
6. File lists, previews and files travel over this connection. A ZIP is packed on the fly while it is sent; nothing is written to disk.
7. The share ends when you close the window. It also ends by itself: a single file after the download, folders 10 minutes after the last phone left, or 30 minutes after start if nobody scanned the code. Then the secret and the key are gone.

The source code is on GitHub.

• The page itself. The phone loads the page (HTML and JavaScript) over plain HTTP, because a local address can get no trusted certificate. Someone who only listens on your Wi-Fi sees the page code, but no secret and no file data. But an attacker who can actively change traffic in your network could swap the page for a fake one and so get the secret and the files. So use Pickup on networks you trust, such as your home or office Wi-Fi, not on public hotspots.
• The QR code. Whoever sees the code can pick up the files while the share is open: over your shoulder, in a screenshot or in a screen share. Close the window to stop sharing at once.
• Your network can see that something happens. Other devices can see that your Mac runs a web server and how much data goes to the phone. They cannot see names or contents.
• The app is not signed by Apple. macOS does not check it. You trust the code on GitHub and the release built from it. You can read the source and build it yourself.

Open System Settings → Keyboard → Keyboard Shortcuts → Services → Files and Folders and turn on Share via QR Code. You can also give it a shortcut there.