Work / 03
Secretly
End-to-end encrypted, one-time links for sharing passwords, API keys and OTPs.
— Notes
Passwords and API keys end up pasted into chats, where they stay forever. Secretly turns a secret into a link that works once, then the secret is gone.
How it works
The browser creates a random 20-character key and encrypts the secret with it before anything is sent. The server stores only the ciphertext and returns an ID. The share link looks like this:
st.hrvs.dev/<id>#<key>
Browsers never send the part after # to a server, so the key travels with the link but never reaches the database. Opening the link fetches the ciphertext, decrypts it on the recipient’s device and deletes it.
Extras
- Password: an optional second layer. The secret is encrypted with the password before the link key is applied, so the link alone isn’t enough.
- One-time redirects: share a private URL instead of text.
- Emails: optionally email the link to someone, and get a read receipt when it’s opened.
What I’d change
This was an early project, and I’d rebuild the core differently today. I’d use the browser’s Web Crypto API with AES-GCM instead of a JavaScript crypto library, and delete the secret on the server as part of reading it, rather than trusting the viewer’s browser to do it.