Skip to content

How it works

From your clipboard to their screen — and then nowhere

A walkthrough of exactly what happens to a secret, and who can see what at each step.

  1. 1

    You write the secret

    Type or paste it into the composer. Nothing has left your device yet. Choose how long the link should live, whether a passphrase is required, and (on paid plans) how many times it may be opened.

  2. 2

    Your browser encrypts it

    A fresh 256-bit random key is generated for this secret alone. Your browser derives an encryption key and a separate “proof” from it with HKDF-SHA256, pads the text to hide its exact length, and encrypts it with AES-256-GCM. If you set a passphrase, it is stretched with Argon2id and mixed into the key, so the link alone is not enough.

  3. 3

    VaultDrop stores ciphertext only

    We receive the ciphertext, a random IV, the Argon2id salt (if any) and a SHA-256 hash of the proof. We never receive the key, the passphrase, or the text. We return a random 128-bit identifier.

  4. 4

    You share one link

    The link looks like /s/<id>#<key>. The part after “#” is a URL fragment: browsers keep it on the device and do not send it in HTTP requests, so it never appears in our server logs. Send the passphrase, if any, through a different channel.

  5. 5

    The recipient opens it once

    Their browser reads the key from the fragment, derives the proof (asking for the passphrase if needed) and sends only the proof. If it matches, VaultDrop marks the secret consumed and deletes the ciphertext in the same database transaction, then returns it. A wrong passphrase leaves the secret untouched — until too many failures destroy it.

  6. 6

    Nothing is left to open

    The recipient's browser decrypts and displays the secret. Any later visit to the link shows that it was already opened. Unopened secrets are destroyed at their expiry time; you can also destroy one early from your private receipt link or dashboard.