How we keep your secret
Security you can verify, not security you have to believe. Here is the full picture.
Client-side encryption
Encryption happens in your browser using the WebCrypto API with AES-256-GCM and a 256-bit key generated from a cryptographically secure random source. The plaintext never crosses the network.
The key lives in the URL fragment
Everything after the # in your link is the decryption key. By specification, browsers never transmit the fragment in an HTTP request. Our servers, our logs, and any proxy in between see only the identifier.
Storage that forgets
Ciphertext is held with an expiry attached. When the lifetime passes or the view budget runs out, the record is dropped — there is no archive to subpoena and no backup to leak.
What we can see
The random identifier of a secret
When it was created and when it expires
The approximate size of the ciphertext
How many views remain
What we cannot see
The content of your secret
The decryption key
Your password, if you set one
Who opened the link