How I built a zero-knowledge, self-destructing secret sharing tool

Описание и применение

ВанишШэр шифрует секреты полностью в браузере, отправляя серверу только ciphertext, а ключ хранится в хеш‑фрагменте URL, что делает сервер недоступным к чтению данных. Секреты автоматически удаляются после заданного времени или количества просмотров.

Задача

Most of us share passwords or API keys in insecure channels, leaving them in search indexes, backups, and inboxes long after they are needed.

Результат

Secrets are encrypted in the browser, the server stores only ciphertext, and the link’s hash fragment contains the decryption key, preventing server‑side decryption. Secrets expire after configurable time or view limits, after which the server deletes the payload.

Рабочий процесс

• Generate a random 256‑bit AES key with the Web Crypto API
• Encrypt the note or file with AES‑256‑GCM
• Send only the ciphertext to the server
• Place the key in the link’s hash fragment

Доказательства

When you create a secret, the browser does the work: 1. Generate a random 256-bit AES key with the Web Crypto API 2. Encrypt the note or file with AES-256-GCM 3. Send only the ciphertext to the server 4. Put the key in the link's hash fragment (#…)

Источник

Browsers leave everything after # out of HTTP requests. A link like this: https://vanishshare.app/s/abc123#<decryption-key> sends only /s/abc123 to the server. The key stays on the sender's and recipient's devices, and the server stores ciphertext it can't decrypt.

Источник

Each secret expires after 10 minutes, 1 day, 1 week or 1 month, and you can cap it at 1, 5, 10 or 20 views or leave views unlimited. Once a secret expires or hits its limit, the server deletes the encrypted payload.

Источник

The server still sees metadata, such as when a secret was created, its size and when it was opened. Like any web app, VanishShare relies on you trusting the JavaScript the server delivers.

Источник