Share a Secret
> return_hub · module_loader · boot
Loading module…
> BOOT_SEQUENCE // ROY-HUB
HOST session.local · SEGMENT PRIVATE_NET · MEM 640K SUFFICIENT [ OK ]
CHECKSUM 0x9f2e · SIG VERIFIED · SESSION ACTIVE [VERIFIED]
> No clutter, no ads, no bait-n-switch—just simple tools that work at no cost
> return_hub · module_loader · boot
> return_hub · module_active
> locked on your device · opened once
Checking whether sharing is available…
0 / 4,000 bytes
Send the link in one channel and the passphrase in another. The link alone cannot open the secret.
Nothing is uploaded until you create the link. Chat previews do not reveal the secret. The recipient has to press Reveal.
Share a Secret encrypts a password or short note in the browser with AES-256-GCM. The decryption key stays in the link fragment and is not sent to the server. The server stores ciphertext until the first reveal or the timer ends, then deletes it.
Encrypt a password or short note in your browser and send a link that works once. The key stays after the #. Ciphertext is deleted on reveal or when the timer ends.
The link looks like /tools/share-secret/v/<id>#<key>. The id is only a lookup token. The key never leaves the browser. A second visit after Reveal finds nothing.
No. The browser encrypts it with AES-256-GCM before upload. The server stores ciphertext and deletes it when the secret is revealed or it expires. The decryption key stays in the link after # and is not included in the request.
Not after the first reveal, and not after the timer you chose. A second visit says the secret has already been opened or has expired.
Chat and link-preview crawlers fetch the page, but they do not press Reveal. The secret is not in the page HTML. Pressing Reveal deletes the ciphertext and decrypts it on the device.
Send the link in one channel and the passphrase in another. The link alone cannot pass the reveal check. The passphrase is not uploaded. Five wrong guesses delete the secret.
No. The database holds ciphertext, a salt, and, if you set a passphrase, a hash of an authentication key. It does not hold the decryption key or the passphrase. A compromised copy of this site could still ship a page that reads the key in the browser.