Question 1

What happens when I share a secret?

Accepted Answer

Your browser generates a share code, derives an encryption key from it, and encrypts your secret before anything leaves your device. The encrypted copy is parked on the server so the receiver can pick it up any time. If both people are online, the secret instead travels directly between the two browsers and the parked copy is deleted immediately.

Question 2

What does the server see?

Accepted Answer

Only ciphertext, a random mailbox id used for routing, and hashed authentication tags. The server never sees the secret, the code words, or the encryption keys. Share links keep the code in the URL fragment, which browsers do not send to servers.

Question 3

Can the secret be read twice?

Accepted Answer

No. The encrypted copy is destroyed the moment it is claimed or delivered directly, five wrong code attempts burn it permanently, and it expires automatically after 24 hours by default (up to 7 days).

Question 4

Can the operators of the service read my secrets?

Accepted Answer

Not by design: keys are derived and encryption happens entirely in the browser, and the server stores only ciphertext. The source code is public for inspection. A direct-transfer-only mode uploads nothing at all, not even ciphertext.

Question 5

How big can a secret be?

Accepted Answer

Up to 10 KB of text: SSH keys, API tokens, passwords, connection strings, or recovery codes, shared from one sender to exactly one receiver.