Send passwords securely, end-to-end encrypted

Create a one-time secret or create a link-only secret →

Encryption happens entirely in your browser. The decryption passphrase never leaves this page. How it works →

How to send a secret securely

1. 1

   Paste your secret

   Your browser generates a 256-bit AES-GCM key locally and encrypts the text in-memory. The plaintext never leaves your device.

2. 2

   Get a link and a passphrase

   We store only the encrypted ciphertext and a random IV. You receive a shareable link (containing the payload ID) and a separate four-word decryption passphrase.

3. 3

   Send over two channels

   Send the link through one channel (email, chat) and the passphrase through a different one (SMS, phone call, in person). An attacker who compromises one channel still cannot read the secret.

4. 4

   One-time view, then gone

   When the recipient opens the link, the server returns the ciphertext and then immediately deletes the record. The recipient enters the passphrase in their browser and decrypts locally - the secret is permanently destroyed.

Why a passphrase, not a string of random characters?

Older tools hand you a decryption key that looks like kQ9$nL2#vX7&pR. It’s strong, but it’s also painful to read aloud, easy to mistype, and visually screams “I am a password.” Anyone glancing at the recipient’s screen or chat history knows instantly what they’re looking at.

Secret Sharing instead gives you four random English words - for example staple-orbit-canvas-river - drawn from a 7,776-word list (the EFF diceware wordlist). Four words means roughly 3.6 quadrillion possible combinations (7776⁴), and each guess has to run through an Argon2id memory-hard derivation (64 MiB of memory, 3 passes) before it can even be tested - so an offline attacker cannot simply throw GPUs at it the way they can with PBKDF2 or bcrypt. Compared to a short random-password string, that is:

• Readable. A recipient can read “staple orbit canvas river” once and remember it long enough to type it.
• Dictatable. You can read it over the phone without spelling out letters or distinguishing 1 from l from I.
• Incognito. Four plain words in a chat look like a note, not a credential. They don’t trigger the “this is a password” reflex in screenshots, screen shares, or shoulder-surfers.
• Harder to mistype. Whole words have fewer ambiguous characters than symbols; a typo usually produces nonsense rather than a near-miss the browser quietly rejects.

The full AES-256 key is derived from your passphrase with Argon2id - the OWASP-recommended memory-hard password hash - using 64 MiB of memory, 3 iterations, 4 parallel lanes, and a per-secret random salt. Password strength checkers such as Bitwarden’s typically rate a four-word diceware passphrase at centuries to crack offline, and Argon2id’s memory cost makes it far more expensive to parallelize on GPUs and ASICs than PBKDF2 or bcrypt.

Frequently asked questions