death.box is a web application for sending end-to-end encrypted messages through the XRP Ledger (XRPL).
- A message is entered directly in the browser.
- The content is encrypted locally before it is sent.
- The encrypted message is stored as a memo on an XRPL transaction.
- The recipient can retrieve the transaction and decrypt the content using the shared passphrase.
- The blockchain acts as a permanently public transport and storage medium.
This application is not a conventional messenger. Messages are not stored on a private server; they are published as blockchain data.
Message content is protected client-side using modern symmetric encryption:
- AES-256-GCM for confidentiality and integrity
- PBKDF2 to derive an encryption key from the passphrase
- The passphrase is not sent to the server and is not stored on the blockchain.
- The server signs the XRPL transaction using a wallet dedicated to this purpose.
Without the correct passphrase, the encrypted message content should not be readable, provided that the device, browser, and delivered application have not been compromised.
Security depends heavily on the passphrase. Weak, short, or reused passphrases may be guessed through offline attacks. Use a long, randomly generated passphrase exclusively for this message and share it through a separate communication channel.
Even when the content is encrypted, the following information remains publicly and permanently visible:
- Sender and recipient addresses
- Timestamp and transaction ID
- Transaction amount and fees
- Memo size and technical structure
- The encrypted ciphertext
The application therefore does not provide complete anonymity. Blockchain entries cannot be deleted or reliably changed after publication.
A compromised device, modified browser profile, malware, or manipulated website delivery could capture messages or passphrases before or during encryption. Encryption cannot protect against a compromised device.
The server requires a wallet to sign transactions. The wallet seed must never be published, committed to the source code, or written to logs. The wallet should contain only a limited testing balance.
Because sending is publicly accessible, the application is also exposed to bots and abuse. This may result in unnecessary transaction fees, excessive requests, or depletion of the wallet balance. A production deployment should add authentication, distributed rate limiting, monitoring, and spending limits.
This project is a technical open-source project, not certified security software. It provides no guarantee of absolute confidentiality, anonymity, or availability. Do not send passwords, private keys, credentials, or information whose loss could cause significant harm.
The server-side transaction sender requires the following environment variable:
DEATHBOX_MEMO_WALLET_SEED=your_server_wallet_seedThis variable must never be exposed publicly. For a public demo, use a separate wallet with a small balance.
The application requires server-side hosting such as Vercel. Purely static hosting, such as GitHub Pages, cannot execute the API route that signs XRPL transactions.
By using death.box, you acknowledge the public and permanent nature of the XRP Ledger. Carefully verify the recipient address, message, and passphrase before sending.
Add the desired license before publishing the repository publicly, such as MIT, Apache-2.0, or a custom license.
Use this project at your own risk. The authors accept no liability for lost funds, incorrectly addressed transactions, disclosed passphrases, compromised devices, unreadable messages, or any other direct or indirect damages.