FAQ
Common questions, short answers.
Is this actually secure?+
Yes. Your browser encrypts the secret with XChaCha20-Poly1305 before it goes anywhere. The server never sees the plain text or the key.
How many views can a secret have?+
You choose the view limit when you create it. Each open uses one. When views hit zero, the secret gets deleted.
How does expiry work?+
You set a time limit. If it runs out before the views are used, the secret gets deleted.
What if I lose the link?+
I can't recover it. The decryption key was part of the link, and I never had it.
How do I share the link safely?+
Send it through whatever channel you'd normally use. If the secret is sensitive enough, send the link and the context about what it's for in separate messages or channels.
Will you email the link for me?+
No. The link contains the decryption key. If I send it, I've seen it. That defeats the point.
Do I need an account?+
No. No accounts, no signup.
Do you log secrets?+
No. The secret is encrypted before it gets to me. I can't read it, so there's nothing to log.
Which algorithms?+
XChaCha20-Poly1305 for the secret. TLS in transit. AES-256 at rest.
Can I report a vulnerability?+
Yes. Send details to security@secret.broker.