Skip to main content
M.ALRASHID
All tools

Send

Share a password, key, or short note through a link that opens a set number of times and then deletes itself. It's encrypted in the sender's browser, and the key travels in the link, never to the server.

Create a secret

Creating links is limited to the site owner for now. Opening a link works for anyone who has it.

How it works

  1. Your browser makes a random 256-bit key and encrypts the secret with AES-256-GCM before anything is sent.
  2. The server stores only the encrypted copy. The key goes in the part of the link after #, which browsers never send to a server.
  3. When someone opens the link, their browser fetches the encrypted copy and decrypts it there. Nothing is sent until they press Reveal, so link scanners can't use up a view.
  4. An optional password works as a second lock: the link alone isn't enough, and five wrong tries destroy the secret.
  5. Each opening uses a view. When the views run out or the secret expires (after 1 hour to 7 days), it's deleted.

What it can't protect against

  • Anyone with the full link can open it, unless you also set a password. Some company email systems copy links they scan, so use a password for links sent by email.
  • Whoever controls the code this site serves could change it to read secrets. That limit applies to every encrypted web app.
  • Once someone has read the secret, they can copy it or take a screenshot.

Where your data goes

This tool needs this site's server to hold the encrypted secret. Nothing is sent until you press Create link or Reveal. Then your browser sends:

  • This site's own API, run by Cloudflaremalrashid.com

    The encrypted secret, a hash used to check the link, a hash of the delete link, and the expiry and view settings. Never the key, the password, or the text.

Like every request to this site, Cloudflare also sees your IP address and the time. The API keeps no logs, and expired or used-up secrets are deleted within 15 minutes.

The server can't read what it stores, because the key never reaches it. Deleted data stays in Cloudflare's database backups for up to 7 days, still encrypted.