Secret Sharing

by WebF1

Link-only mode

How link-only secret sharing works

This page explains the link-only mode of Secret Sharing. In this mode, the encrypted payload lives entirely in the URL - no database, no API write, no server record. For the default stored mode (which uses a database backend and a true one-time read), see how the stored mode works.

The encryption flow

  1. You paste a password or any sensitive text on the link-only create page.
  2. The browser generates a four-word English passphrase from the EFF diceware wordlist and derives a 256-bit AES-GCM key from it via Argon2id (64 MiB memory, 3 iterations, 4 parallel lanes, per-secret random salt). Argon2id is memory-hard and OWASP-recommended, so an attacker cannot cheaply parallelize brute-force attempts on GPUs or ASICs.
  3. A random 96-bit initialization vector (IV) and 128-bit salt are generated with crypto.getRandomValues.
  4. Instead of encrypting the raw text, the browser encrypts a small JSON envelope: { "text": …, "exp": <ISO 8601 expiry> }. Wrapping the expiry into the encrypted plaintext means it is authenticated by AES-GCM's auth tag - a viewer cannot strip the expiry by editing the URL.
  5. The IV (12 bytes), salt (16 bytes), and ciphertext are concatenated and base64url-encoded with a v1. version prefix. The full token becomes the URL fragment: https://secret.webf1.com/local/v#v1.….
  6. No network request is made. Nothing is sent to any server. The link is the only copy of the encrypted payload.

The decryption flow

  1. The recipient opens the link. The browser requests /local/v from the web server - but the part after the # (the encrypted payload) stays in the browser and is never transmitted.
  2. The recipient's browser reads the fragment, strips the v1. prefix, base64url-decodes the blob, and slices out the fixed-length IV and salt.
  3. The recipient enters the four-word passphrase (received over a separate channel). The browser re-derives the AES-256 key via Argon2id and decrypts the ciphertext.
  4. The browser parses the JSON envelope and checks exp > now. If the secret has expired, it refuses to display the plaintext.
  5. On a successful decrypt, the browser calls history.replaceState to clear the fragment from this tab's address bar, as a best-effort one-time gesture.

What link-only mode cannot do

  • No true one-time read. Because the payload is in the URL, anyone who saved or copied the link before the recipient opened it can still decrypt it. The address bar is cleared on the recipient's tab only - that does not affect copies elsewhere.
  • No recovery. If the link is lost before the recipient opens it, the secret is gone. There is no server row to fall back to.
  • URL length limits. Browsers support URLs from ~2,000 characters (conservative) up to 64K+ (modern). Some chat and email clients truncate URLs around 2,000 characters. Link-only mode is best for short secrets - passwords, tokens, short notes.
  • Expiry is client-enforced. The recipient's browser checks the expiry, but the link itself never becomes unreachable - it just stops decrypting. A malicious recipient could in principle modify the page to skip the check; they cannot, however, forge a future expiry without the passphrase and a new encryption.

Why a four-word passphrase

The decryption key is a four-word English passphrase drawn from the 7,776-word EFF diceware wordlist - roughly 3.6 quadrillion combinations (77764). Each guess has to run an Argon2id memory-hard derivation (64 MiB of memory, 3 passes, 4 parallel lanes) before it can be tested against the ciphertext - meaning an attacker cannot simply throw thousands of GPUs at it the way they can with PBKDF2 or bcrypt. Despite a nominal ~51.8 bits of entropy, password strength checkers such as Bitwarden's typically rate this kind of diceware passphrase at centuries to crack offline. It is also far easier to read, dictate over the phone, and recognize than a random-character string. The same passphrase mechanism is used in both modes.

Try it

Ready to create a link-only secret? Open the link-only generator → Or compare it with the stored (server) mode.