Encrypted notes and files that self-destruct
classified sends a note or a file that encrypts in your browser, opens once, and leaves no readable copy behind. The server receives ciphertext and an opaque identifier. It never receives the decryption key, so it cannot open what it stores even under legal compulsion.
What happens when you send one
- Your browser generates a random 128-bit secret and derives an AES-256-GCM key from it. Nothing has left the tab yet.
- The ciphertext is uploaded and stored under a 12-character identifier with the expiry you chose. The key is placed after the
#in your link, which browsers never send to a server. - Your recipient opens the link once. The stored copy is deleted and decryption happens in their browser.
The exact parameters are published on the security page, and the request flow, including its failure modes, on how it works.
What the server never receives
- The decryption key, which lives only in the link fragment.
- The note text, the file contents, or the file name.
- A sender or recipient identity, because neither is ever asked for.
What it does see is the size of the ciphertext, when a share was created, expired or read, and whether a password was set. That is not nothing, and pretending otherwise would be dishonest.
Limits worth knowing before you rely on it
- A share lives between 5 minutes and 24 hours, then expires whether or not anyone opened it.
- Notes are capped around 200 KB of ciphertext. Files default to 10 MB and need an account with a verified email address; notes do not.
- One-time delivery is a strong default, not a transactional guarantee, and an automated link scanner can be the first reader.
- Nothing is recoverable. A lost link or forgotten password means the content is gone, including for us.