Everything you need to know before trusting us with a secret.

Is Secret Drop free?

Yes. No account, no subscription, no hidden fees.

Do I need an account?

No. No registration, no tracking. Unless you enter an email to manage them, nothing links your secrets to you.

How do I securely share a password?

Paste your password, choose an expiration time and, if you want, limit it to a single read. Secret Drop encrypts it in your browser and gives you a secure link to share.

What is the maximum file size?

Up to 10 MB for files and 50,000 characters for messages. Your browser encrypts files before upload.

How is my data encrypted?

Your browser generates a random key and encrypts the content locally with AES-256-GCM, the algorithm recommended by NIST, via the Web Crypto API from the W3C. The server only receives encrypted data and never sees the plaintext.

Can the server read my secrets?

No. The decryption key stays in the URL fragment (after the #), and browsers never send the fragment to the server. Without the key, the server has no way to decrypt your secrets.

What happens after a secret is read?

Once the secret reaches its read limit, the server permanently deletes the encrypted content and keeps only a trace of its existence. If someone intercepts the link afterwards, they find nothing to decrypt. Without a read limit, the secret stays available until it expires.

Where is the data stored?

On servers located in France. The server stores only encrypted data and never has access to the plaintext.

Is Secret Drop GDPR compliant?

Yes, by design. Zero-knowledge encryption, no tracking, no advertising cookies, automatic deletion of expired data. Secret Drop stores no personal data in plaintext.

Is Secret Drop open source?

Yes, under the GNU Affero General Public License v3 (AGPL-3.0). You can inspect the code, verify there are no backdoors and confirm the architecture works as described.

How is this different from encrypted email?

Encrypted email (PGP, S/MIME) requires both parties to set up keys beforehand. With Secret Drop, your recipient only needs the link. The secret also self-destructs, while an email stays in both inboxes.

How do I manage my secrets after creating them?

If you provided your email, you can revoke or extend your secrets via the “Manage my secrets” link at the bottom of every page. You will receive a single-use magic link, valid for 10 minutes. Without a password, there is nothing to steal.