Send a password or private note as an encrypted link
Type the secret, get a link. The encrypted text lives inside the link itself, so there is no server copy, no account, and nothing for us to leak.
Drop your file here
or click to browse
Nothing has left this page since you opened the tool. Show network activity
The browser enforces this: the site’s security policy only lets the page talk to the code libraries’ servers and an anonymous usage counter (tool name, file type, size range). A request carrying your file to anywhere else would be blocked before it left.
Check it yourself: open your browser’s developer tools, go to the Network tab, and run the tool. Or turn off Wi-Fi once the tool has loaded; it keeps working.
How it works
Type the secret, get a link. The encrypted text lives inside the link itself, so there is no server copy, no account, and nothing for us to leak.
Pasting a password or bank detail straight into WhatsApp, SMS or email leaves it as readable text in the chat, in search, in notification previews and in cloud backups. This tool encrypts it first. Your browser makes a random 256-bit AES-GCM key, encrypts the text, and puts both into a link after the # sign. Browsers never send the part after # to any server, not when the page loads and not in the Referer header, so the recipient's browser decrypts it locally. Our server only ever sees a request for the page. For stronger protection, add a passphrase: the link then holds only the encrypted text and a random salt, the key is derived from the passphrase with PBKDF2-SHA256 (600,000 rounds), and you send the passphrase a different way, such as on a call. The recipient taps Reveal, and can then copy the secret and clear it from the tab. The limits, plainly: anyone who has the link can read it unless you add a passphrase. The link cannot expire or self-destruct, because nothing is stored anywhere that could be deleted. Your chat app keeps the link as long as it keeps the message. For a real password, use a passphrase or change the password once it has been used. Secrets are capped at 1,000 characters so the link stays under about 2,000 characters, which chat apps and SMS handle reliably.
How to use it
- Type the secret. A password, backup code, bank detail or short note, up to 1,000 characters. Add a passphrase if you want the link to be useless on its own.
- Copy or share the link. Your browser encrypts it and builds the link. Send it on WhatsApp, SMS or email; send any passphrase a different way.
- The recipient taps Reveal. It decrypts in their browser. They copy it, then clear it from the tab.
Frequently asked questions
- Where is my secret stored?
- Nowhere. It is encrypted in your browser and the result is the link. The part after # is never sent to our server or anyone else's, so there is no copy to leak, subpoena or delete.
- Can the link expire or be read only once?
- No. Expiry and one-time links need a server that holds the secret and deletes it after it is read. This tool deliberately stores nothing, so the link works for as long as someone has it. If that matters, use a passphrase, or change the password after it has been used.
- Can WhatsApp or other chat apps read it?
- The chat app stores the link, so anyone with access to the chat (or its backup) has the link. Without a passphrase, the link alone opens the secret. With a passphrase sent another way, the link by itself is useless. Link previews don't reveal it: preview bots never receive the part after #, and the page only decrypts when a person taps Reveal.
- How strong is the encryption?
- AES-256-GCM through your browser's built-in Web Crypto. Without a passphrase, the random key is inside the link. With one, the key comes from PBKDF2-SHA256 with 600,000 rounds and a random salt; a long, uncommon passphrase is what makes it hold up, because anyone with the link can try guesses offline.
- Why is there a length limit?
- The whole encrypted secret travels in the link. Links over about 2,000 characters get cut off by some chat apps and SMS, so secrets are capped at 1,000 characters (less for scripts like Hindi that take more bytes per character).