When you share a password by email or Slack, it remains readable by every intermediary. Secret Drop ensures a secure exchange of your confidential data: everything is encrypted in your browser before it leaves your screen. The server only receives noise.
How your secret is protected
-
You write your secret
You enter your message or select a file in your browser.
-
Encryption in your browser
Your browser generates a random key and encrypts the content locally with AES-256-GCM via the Web Crypto API. The server only receives encrypted data.
-
Server stores ciphertext
The server only stores encrypted data. It cannot decrypt it because it never has access to the key.
-
Key stays in the URL
The decryption key is placed in the URL fragment (after #). This part is never sent to the server by the browser.
-
Recipient decrypts
When the recipient opens the link, their browser fetches the encrypted data and uses the key from the URL to decrypt locally.
-
The secret is destroyed
Once the read limit is reached or the expiration passes, the encrypted content is permanently deleted from the server. Only a trace of its existence remains — there is nothing left to decrypt.
Secure by design
Security is not a feature we added — it is the foundation of every architectural decision.
Zero-knowledge
The server never receives the encryption key — following OWASP cryptographic storage principles. Even if the database is compromised, an attacker only gets useless noise. This is not a promise — it is a mathematical impossibility.
Passwordless authentication
A single-use magic link replaces the password. Nothing to steal, leak or brute-force. A compromised database reveals no credentials, because there are none.
The key never leaves your device
The decryption key lives in the URL fragment (after the #). By HTTP protocol design, this part is never sent to the server — not in requests, not in logs, not anywhere.
Permanent destruction
A secret that has been read no longer exists. The encrypted content is deleted from the server — only a trace of its existence remains. Expiration and read limits reduce the window of exposure to the strict minimum.
Hosted in France
Infrastructure hosted in France, under European Union jurisdiction. Your data is subject to GDPR and never leaves the EU. No transfer to third countries, no exception.
No tracking
No third-party cookies, no tracking pixels, no external services. No data is shared with third parties. Your activity on this site is not profiled, sold or monetized.