My gym forced a social media down my throat. So I reverse-engineered its app

A gym’s membership app made its social feed the home screen and prompted users to share workout stories after checking out. Although the app was polished, its author needed it only to display a rotating QR code at the turnstile and objected to being forced through an unfilterable feed. He set out to reproduce the QR-code function independently, while avoiding identifying the gym or himself. Turning off Wi-Fi showed that codes could be generated offline for a limited period, suggesting the app stored the necessary credentials locally.

With help from AI coding tools, he inspected the Flutter app’s compiled code, Android components, and a rooted phone. The QR code proved to contain an encoded account handle, an encrypted expiration time, a random nonce, and a checksum; generating valid codes required two account-specific secrets. The app’s logs had recorded relevant network payloads, leaving the key material in a plain-text file on the device. He used it to build a small SvelteKit web app, correcting details such as millisecond timestamps, base64url encoding, and AES-128-CTR implementation. Comparing its output with the original app and independently decoding the QR image confirmed an exact match. The web app successfully checked him in and out, though it did not provide standalone login and would still require refreshed keys when the stored credentials expired.