Encrypted in your browser
When you create a secret on the home page, your browser generates a random 256-bit key and encrypts the text with AES-256-GCM using the Web Crypto API. Only the ciphertext is sent to our servers.
The key goes into the part of the link after the # sign. Browsers do not include that part in requests, so it never reaches our servers. Whoever opens the full link decrypts the secret in their browser.
Passphrases
A passphrase is stretched with PBKDF2 into two independent values. One is mixed into the encryption key, so the secret cannot be opened without both the link and the passphrase. The other is a proof that we check before releasing the ciphertext, and we store only a one-way hash of it. We never see the passphrase.
Secret requests and chat rooms
- Secret requests: the requester's browser creates a key pair and keeps the private key. The person responding encrypts to the public key in their own browser. Only the requester's browser can open the result, so open it on the device where you created the request.
- Chat rooms: new rooms use a key in the invite link. Messages are encrypted in each browser and our server relays ciphertext. Rooms created before this update use encrypted connections only.
What is still encrypted on our server
- File attachments are encrypted on our server when stored, not in your browser.
- Secrets that include an email notification use server-side encryption, because an emailed link could not carry the key privately.
A limit of any browser-based tool
Because the encryption code is delivered by our website, you are trusting that we serve honest code. This is true for every browser-based secret-sharing tool, including those that encrypt in the browser. If your threat model cannot accept it, use a self-hosted or command-line tool.
What we log and how long we keep it
- Application logs record the request method, path with secret identifiers removed, status code and timing. They contain no secret contents, keys, passphrases or IP addresses.
- Log files are deleted after 7 days.
- Guest usage is counted with a hashed token that changes every month; we do not store your IP address with your secrets.
- Our hosting and network providers may keep their own technical logs.
Deletion
A secret is deleted when it reaches its view limit or expires. Links to deleted secrets only show that the secret no longer exists.
Frequently asked questions
Can SecureVoult read my secrets?
Secrets are encrypted at rest, but the encryption is applied on our servers, so the service can technically decrypt a secret when its link is opened. We do not log or analyse secret contents, and secrets are deleted after viewing or expiry.
What happens if someone opens my link first?
They would see the secret and the intended recipient would get an error, so send links directly and add a passphrase for sensitive items.
Is SecureVoult open source?
No. If you need to inspect or host the code yourself, an open-source tool is a better fit.
Share a secret now
Create a one-time, self-destructing link in seconds. No account needed.
Create a secret link