zero-knowledge · open source · self-destructing

The server can't read
your secrets.

Everything is encrypted and decrypted in your browser with AES-256-GCM. The server holds ciphertext for a little while and counts views. It has no key and no way to read anything — by design, not by policy.

Read the source

The flow

  1. 01A random 256-bit key and nonce are generated in your browser.
  2. 02Your .env is encrypted locally. Only ciphertext goes to the server.
  3. 03The key is placed in the link's #fragment — browsers never send fragments to servers.
  4. 04The recipient's browser reads the key from the fragment and decrypts locally.
  5. 05On open, the secret is burned: the ciphertext is deleted from the store.

No key in the URL at all.

For channels you don't trust (WhatsApp, email, Slack), use a recipient-keyed drop. The sender never puts the key anywhere public.

  1. 01Bob generates a P-256 keypair in his browser. The private key never leaves his device.
  2. 02Bob shares his receive link — it contains only his public key, not a secret.
  3. 03Alice visits the link and encrypts with ECDH + HKDF into AES-256-GCM. The drop URL has no key fragment.
  4. 04Even if someone intercepts Alice's drop link, they get only ciphertext. Decryption requires Bob's private key.

What's under the hood.

PrimitiveRole
AES-256-GCMSymmetric encryption for the secret payload
ECDH P-256Key agreement for recipient-keyed drops
HKDF-SHA-256Key derivation from ECDH shared secret
Web Crypto APIAll crypto runs in the browser — no library code touches your plaintext

Protected threats.

covered

Database or server breach

Only ciphertext is stored. The key is never sent, so a full dump is noise.

covered

Network sniffing

TLS in transit, and the key rides in the URL fragment — never transmitted to any server.

covered

Replay / re-reading a link

View-once burn plus a TTL the datastore enforces itself.

covered

A rogue operator

Zero-knowledge means even we can't read your secret. There's nothing to hand over.

Where the edges are.

We'd rather tell you the limits than overclaim. These gaps are inherent to every end-to-end web app.

your call

A compromised device

If the sender's or receiver's machine is already owned, no web app can protect the plaintext once it's decrypted there.

your call

Trusting the served JavaScript

You're trusting that the code we serve is the honest code. Mitigations: strict CSP, no third-party scripts on crypto pages, open repo you can audit or self-host.

your call

A leaked link

Anyone with the full link can open the secret once. Use a recipient-keyed drop (via your receive address) if the channel isn't trustworthy.

Don't take our word for it.

The code is open. Audit it, file an issue, or run your own instance.

ashdrop drop it. it turns to ash.