A password you send by email or Slack stays readable in the mailboxes, backups and chat history of each service it crosses. Secret Drop encrypts your confidential data in your browser before sending it, so the server only receives data it cannot read.
How your secret is protected
-
You write your secret
You enter your message or select a file in your browser.
-
Encryption in your browser
Your browser generates a random key and encrypts the content locally with AES-256-GCM via the Web Crypto API.
-
Server stores ciphertext
The server stores the encrypted data without the key, so it has no way to decrypt it.
-
Key stays in the URL
Your browser places the decryption key in the URL fragment (after the #). Browsers never send this part to the server.
-
Recipient decrypts
When the recipient opens the link, their browser fetches the encrypted data and uses the key from the URL to decrypt locally.
-
The secret is destroyed
Once the secret reaches its read limit or expiration date, the server permanently deletes the encrypted content. Only a trace of its existence remains, with nothing left to decrypt.
Secure by design
Each architecture choice below limits what an attacker could access, and what we can access ourselves.
Zero-knowledge
The server never receives the encryption key, following OWASP cryptographic storage principles. An attacker who steals the database only gets encrypted data they cannot decrypt.
Passwordless authentication
A single-use magic link replaces the password. The database stores no credentials, so an attacker who steals it has nothing to crack.
The key never leaves your device
The decryption key sits in the URL fragment (after the #). Browsers never send the fragment to the server, so the key appears neither in requests nor in server logs.
Permanent destruction
Once a secret reaches its read limit or expires, the server deletes the encrypted content and keeps only a trace of its existence. A short expiration and a read limit shorten the time your secret stays exposed.
Hosted in France
Our servers are in France, under European Union jurisdiction. Your data falls under the GDPR and stays in the EU, with no transfer to third countries.
No tracking
No third-party cookies, tracking pixels or external services. We share no data with third parties, and we don't profile or sell your activity on this site.