How a URL fragment carries an encryption key
The portion of a URL after # is a fragment. Browsers normally do not send it in HTTP requests, which lets Strumio deliver ciphertext from the server while the recipient browser receives key material from the complete link.
By Strumio Editorial Team · Published August 28, 2026 · Updated August 28, 2026
Distinguish the path, query, and fragment
A web address can contain an origin and path, an optional query after ?, and a fragment after #. Browsers normally send the path and query to the destination server but use the fragment locally. Strumio places random decryption key material in that local fragment so it is not included in ordinary server requests for the message.
The server can still know the message identifier from the path and process delivery metadata and ciphertext. Fragment handling does not hide the fact that a page was requested, make the user anonymous, or remove operational records required for rate limiting, expiration, and one-time consumption.
Follow the complete-link decryption flow
The sender's browser encrypts content before upload. It then creates a complete SecretLink that combines the server-visible identifier with the browser-held fragment key. The recipient requests ciphertext using the path, and client code reads the fragment locally to decrypt with the Web Crypto API.
If the fragment is missing or altered, the browser does not have the correct key and Strumio cannot reconstruct it from the encrypted record. Browser-local recovery or an exported recovery file may help only when previously saved by the authorized sender. Otherwise lost key material makes the ciphertext unavailable to decrypt.
Treat the full URL as the secret-bearing object
Although a destination server does not receive the fragment in normal HTTP requests, the application used to transmit or display the complete URL may see it. Email providers, chat apps, clipboard sync, screenshots, browser extensions, QR readers, device backups, and recipients can copy or retain the full string.
Send complete links directly to verified recipients and avoid public documents, social posts, tickets, link shorteners, and analytics-enabled redirectors. A Strumio QR code is generated locally, but it encodes the same complete link and should be protected like the text URL.
Add controls without overstating them
An access password can create another barrier if strong and sent over a separate channel. Expiration limits how long the stored encrypted payload remains retrievable. One-time mode allows one successful payload claim and rejects later retrieval attempts. These controls reduce different risks and can be combined where appropriate.
None proves who holds the link, prevents first-view copying, or repairs a compromised endpoint. If the wrong person may have viewed a password, API key, recovery code, or invitation, revoke or rotate it at the issuing system instead of waiting for the SecretLink to expire.
Use fragments as one layer, not a complete threat model
Fragment key delivery is a practical browser mechanism for separating normal server requests from key material. Its benefit depends on the sender and recipient preserving the complete link, using the intended Strumio origin, and keeping their devices free from software that can inspect page state.
Pair the mechanism with identity verification, minimal payload context, trusted endpoints, short retention, and least-privilege revocable secrets. For durable shared access, move the result into an approved password manager or secrets system rather than treating an old complete URL as permanent storage.
Related guidance
When an encrypted delivery link is appropriate, Create a free Strumio account.