How SecretPacket works
A simple, private way to share sensitive information once.
- 1
Write your secret message
Type any sensitive text — a password, a private note, an access token. No account needed. Nothing logged.
- 2
Your browser encrypts it
Before the message ever leaves your device it is encrypted using AES-256-GCM. The key is generated randomly for each secret.
- 3
A one-time link is generated
The encrypted message is stored temporarily. A unique link is created with the secret ID and decryption key in the URL fragment. Our servers never see the key.
- 4
You send the link
Share the link via any channel. If you added a password, share it separately — never in the same message.
- 5
The recipient reveals the secret
When the recipient opens the link, their browser fetches the encrypted message and decrypts it locally using the key from the URL fragment.
- 6
The secret is destroyed
The moment the encrypted message is served it is permanently wiped from the database. Any further attempts to open the link show a "secret unavailable" message.
The encryption in detail
When you create a secret, your browser generates a random 256-bit AES-GCM encryption key. This key never leaves your browser and is never sent to our servers.
Your message is encrypted using this key. Only the ciphertext and a random initialisation vector (IV) are stored in the database. We cannot read your message.
The decryption key is placed in the URL fragment — the part after #. Browsers never include the fragment in HTTP requests, so our server never receives or stores the key.
When the recipient opens the link, their browser reads the key from the fragment, fetches the ciphertext from the server, and decrypts the message entirely client-side.
Immediately after the ciphertext is served, it is wiped from the database. The link cannot be used again.