Secret Menu
Turn a password, API token or one-time code into an encrypted link. It is sealed in your browser and unsealed in the recipient's — the secret never touches our server.
We never see your secret. Encryption runs in your browser with the Web Crypto API and the result lives entirely in the part of the link after #, which browsers never send to any server. This page makes no network request with your data — and you can verify that yourself.
Stretched with PBKDF2-HMAC-SHA256, 600,000 iterations. A random key is stronger than any passphrase you can remember; pick this only when you cannot send a second string.
This message is never sent to our server. Closing this tab without copying the link means the secret is lost — there is nothing to recover from.
Your secret link
Piece 2 — the key
Someone sent you a secret
The secret
Removes the encrypted part from this tab's address bar and history entry. The original link still exists wherever it was sent to you (chat, email, ticket) — this tool cannot erase that copy.
How it works
Encryption
- AES-256-GCM (authenticated — tampering is detected)
- Fresh random 96-bit IV for every message
- Browser-native
crypto.subtle, no crypto library - Passphrase mode: PBKDF2-HMAC-SHA256, 600,000 iterations, random 128-bit salt
Why the fragment
- Browsers never send the part after
#to the server - It is absent from server logs, referrers and link previews
- The page you load is the same empty page for everyone; the decrypt happens only in your tab
- Fragment is base64url, fields separated by
.
Link formats
#A1.key.iv.ct— self-contained#B1.iv.ct— split, random key#B2.salt.iv.ct— split, passphrase- The prefix versions the format so older links keep working if the KDF changes
Trust, but verify
- Open DevTools → Network before generating or revealing: no request carries your data
- View this page's source: the whole tool is one short script plus the site's shared crypto-common.js helper (base64url, PBKDF2, AES-GCM — also used by the encrypted compliance export)
- No third-party scripts, fonts or analytics anywhere on this site
- Uses the same zero-knowledge link pattern popularised by tools like PrivateBin
Limits: text only, 2,000 characters, no files. There is no burn-after-read: a link stays readable for as long as it and its key exist, so delete the message that carried it once it has been used. For files or anything larger, use age, GPG or a proper secrets vault.