Vuash is a simple web app that lets you share plain text through a single access link.
All encryption is done by the browser, no secret keys touch the server, and only the encrypted message is stored in the database.
- Browser encrypts the message and generates a secret key
- Browser discards unencrypted message
- Browser passes secret key along via URL fragment (not contained in the request)
- Server stores encrypted message in the database
- Browser shows message link by concatenating the encrypted message's unique URL with the secret key
- Server sends encrypted message
- Browser decrypts message with the secret key in the URL fragment
- If key is valid, show contents
- If key is invalid, show warning
- Server destroys the message
The app running at http://vua.sh is hosted on Heroku, with manual deploys from this master branch. Production code is always paired with this repository.
We currently pay for Vuash's domain from our own pocket. Please consider donating 🙏
