Security

How it works

The person receiving the secret creates a key pair in their browser. The public key goes in the receiving link; the private key stays in their tab. The sender uses the link to encrypt the secret and sends back an encrypted reply. The recipient’s tab uses its private key to decrypt it.

The browsers don’t need a live connection to each other. Once the page has loaded, encryption and decryption also work offline. A lost or expired receiving key means starting again with a new link.

Checking the link

Before sending, open “Check the link” and compare the code with the recipient on a call or in person. This checks that nobody replaced their receiving link with a different one in your chat.

Anyone with a receiving link can encrypt a reply to it. Decrypting a reply successfully doesn’t prove who sent it.

Encryption

We use HPKE (RFC 9180): X25519 key agreement, HKDF-SHA-256, and AES-128-GCM. The hpke-js library uses the browser’s Web Crypto API. Each encryption uses a fresh sender key.

The receiving link contains a 32-byte public key, a version, and an expiry, encoded as 50 Base58 characters. The whole request is authenticated with the encrypted reply. Altered replies are rejected. The maximum secret size is 8,192 UTF-8 bytes; the encrypted reply’s length reveals the secret’s length.

Read the code

The JavaScript served by this site is unminified. Our modules keep their source comments. Dependencies are bundled locally, with their original sources in the source map.

• Encryption and message format
• Key storage and expiry checks
• Page behavior and cleanup
• QR scanner · Dependencies

Limits

The seven-day expiry is enforced by this app. Someone who saves a private key can still use other software to decrypt a saved reply later. Browser memory, session backups, and clipboard history can retain copies after this app clears them.

This keeps the secret out of readable chat history. It can’t protect against a compromised device, browser extension, or modified site code, and it can’t stop the recipient from keeping a copy. This app hasn’t had an independent security audit.

What’s stored and when it clears: Privacy.