A one-time encrypted zero-knowledge password/secret sharing application focused on simplicity and security. No database or complicated set-up required.
- PHP 5.6+
- Web server
Copy the contents of this repository to document root of your web server. Copy settings.example.php to settings.php and make customizations to that file
To further increase security, disable access logging in your web server's configuration so nothing sensetive (IP addresses, useragents, timestamps, etc) are logged to disk.
Summary Of How It Works
secrets.sqlitesqlite database created (if it doesn't already exist).
- Random 256-bit AES key is created
- Random 256-bit AES static key is created (if one doesn't exist already)
- Random 128-bit IV is created
- Random 64-bit ID is created
- ID + AES key is hashed with bcrypt
- Submitted text is encrypted with AES-256-CBC using AES key and random IV
- Ciphertext is now encrypted with AES-256-CBC using static AES key and random IV
- ID and AES key joined (known as
- ID, IV, bcrypt hash, and ciphertext stored in DB
kvalue returned to user in one-time URL
- Example URL:
- Example URL:
kvalue removed from URL and base64 decoded
kvalue split into two parts: ID and AES key
- IV, bcrypt hash, and ciphertext looked up from DB with ID from
kbcrypt hash compared against bcrypt hash from DB (prevents tampering of URL)
- Ciphertext decrypted with static AES key and IV
- Ciphertext decrypted with AES key from
- Entry deleted from DB
- Decrypted text sent to user
Donations are not expected, but they are very appreciated!