How it works
The short version: your secret is locked before it leaves your device, and we never hold the key. Here is the longer version, still in plain words.
- 1
You write the secret
Before anything is sent, your browser locks it with AES-256 encryption, the same standard banks and governments use. This happens on your device, not on a server.
- 2
We store a sealed box
What reaches us is unreadable ciphertext plus an expiry date. No key, no passphrase, no plaintext, ever.
- 3
The link carries the key
The key lives in the part of the link after the # symbol. Browsers never send that part to any server, ours included. It exists only in the link itself.
- 4
They open it once
When your recipient clicks Reveal, their browser collects the sealed box and unlocks it locally with the key from the link. The secret is assembled only on their screen.
- 5
It burns
That reveal was the one read. The sealed box is destroyed on our side, and the link now leads to ash. Unopened links burn on their own when they expire.
Why we cannot peek
This is not a policy promise, it is how the system is built. The key never arrives here, so there is nothing to peek with. If someone stole our entire database, they would hold sealed boxes and expiry dates. The keys are scattered across the world in links we never saw.
Live 2FA codes
A 2FA share seals the secret that generates codes, not a single code. Your recipient's browser runs the same math an authenticator app runs, so they see a fresh code every 30 seconds while they sign in. The generating secret stays sealed inside the link, codes are computed on their device, and the viewing session wipes itself when it ends.
Passphrases add a second ingredient
Add a passphrase and opening the secret needs two things: the key inside the link and the passphrase, which is never sent to us either. Share them through different channels, the link by email and the passphrase by text, and neither channel alone is enough.
Requests reverse the flow
A secret request is two links born together on your device: a request link you send, and a pickup link you keep. The request link can only seal, the pickup link is the only thing that can open. Whatever the other person submits is locked in their browser before it travels, readable exactly once, by you alone.
What burning means
- Reading is deliberate. Email scanners and chat apps prefetch links, so simply loading the page never consumes a view. Only clicking Reveal does.
- Destroyed, not hidden. When a secret burns, the ciphertext is erased. There is nothing left to recover, including by us.
- You can strike the match yourself. Every share includes a private management link to check status or revoke early.
What we keep
Sealed boxes until they burn, expiry dates, and, for signed-in users, an open history showing when a share was revealed and from which country. No IP addresses on shares, no keys, no plaintext, and nothing after the burn.