How encrypted secret links work
Understand browser-based encryption, decryption keys, passwords, expiration, and one-time messages before sharing sensitive information.
How does SecretLink encrypt a message?
SecretLink uses the Web Crypto API to encrypt text with AES-GCM in your browser. Only ciphertext and the initialization vector are sent to the server.
Where is the decryption key stored?
The random key is placed in the URL fragment after the # symbol. Browsers do not send URL fragments in HTTP requests, so the key is not included in SecretLink server logs or message records.
What happens if I lose the complete link?
SecretLink does not store decryption keys. If the complete link is lost, the ciphertext cannot be recovered by SecretLink.
What does One-Time View mean?
A one-time message can be retrieved once. SecretLink atomically marks it as consumed so a second request cannot retrieve the encrypted payload.
Can I add a password or expiration date?
Yes. You can require an access password, set an expiration time, or combine those controls with one-time viewing.
What should I share with SecretLink?
SecretLink is designed for passwords, recovery codes, API keys, private notes, access instructions, and other short text that should not remain in email or chat history.