Is this secure?

Can we read your secret?

No. When you press Create link, your browser generates 32 random bytes from the operating system's cryptographic random source. Those bytes are the key. They are run through HKDF-SHA256 with a random salt to derive an AES-256-GCM content key, and your text is encrypted with it under a random 12-byte nonce.

Your browser then sends us the ciphertext, the nonce and the salts — never the key, and never your text. The key is appended to the link after a #. Browsers do not transmit that part of a URL, so it never appears in a request, a server log, a proxy log or a Referer header.

If you add a passphrase, it is stretched with PBKDF2-SHA256 over 600,000 iterations and mixed into the key derivation, so the link alone is not enough to decrypt. We store no verifier for it: whether a passphrase is correct is decided by the AES-GCM authentication tag, in your browser.

How a secret is destroyed

A reveal is a single database statement that flips the secret's state and clears its ciphertext at the same instant. Two people opening the same link at the same moment produce exactly one success. Loading the page does not reveal anything — that takes a button press — so link scanners and chat previews cannot destroy a secret in transit.

How this differs from other one-time secret services

The create and reveal flow is the same on purpose: paste a password, get a one-time secret link, one view, gone. Other hosts typically encrypt at rest with a key the server holds, so the operator could read a secret in the window between creation and reveal. Here the key never reaches the server, so a copy of the database, a backup, or a subpoena yields ciphertext and nothing else.

What we cannot clean up after you

Pressing Copy puts the text in your clipboard, and clipboard managers keep history. The revealed secret stays on screen until you close the tab. Both are yours to clear; we have no way to reach either.

The two limits, stated plainly

Anyone who has the whole link can open the secret. That is what the passphrase is for, and it is why the link works only once, so a stolen one is noticed: the intended recipient finds the secret already gone, and the sender's private page shows a read time they cannot account for.

You are trusting us to serve honest JavaScript. We cannot read your secrets at rest and we do not want to be able to — but a hostile version of this page could be written, and you have no way to check from here. This is true of every service of this kind that runs code in your browser, and we would rather say so than imply otherwise.