How I built a zero-knowledge, self-destructing secret sharing tool

说明与用途

VanishShare 在浏览器中完全加密秘密，仅将密文发送到服务器，并将解密密钥存储在 URL 哈希片段中，防止服务器读取数据。秘密在可配置的时间或查看次数后过期并被删除。

问题

Most of us share passwords or API keys in insecure channels, leaving them in search indexes, backups, and inboxes long after they are needed.

结果

Secrets are encrypted in the browser, the server stores only ciphertext, and the link’s hash fragment contains the decryption key, preventing server‑side decryption. Secrets expire after configurable time or view limits, after which the server deletes the payload.

工作流

• Generate a random 256‑bit AES key with the Web Crypto API
• Encrypt the note or file with AES‑256‑GCM
• Send only the ciphertext to the server
• Place the key in the link’s hash fragment

证据

When you create a secret, the browser does the work: 1. Generate a random 256-bit AES key with the Web Crypto API 2. Encrypt the note or file with AES-256-GCM 3. Send only the ciphertext to the server 4. Put the key in the link's hash fragment (#…)

来源

Browsers leave everything after # out of HTTP requests. A link like this: https://vanishshare.app/s/abc123#<decryption-key> sends only /s/abc123 to the server. The key stays on the sender's and recipient's devices, and the server stores ciphertext it can't decrypt.

来源

Each secret expires after 10 minutes, 1 day, 1 week or 1 month, and you can cap it at 1, 5, 10 or 20 views or leave views unlimited. Once a secret expires or hits its limit, the server deletes the encrypted payload.

来源

The server still sees metadata, such as when a secret was created, its size and when it was opened. Like any web app, VanishShare relies on you trusting the JavaScript the server delivers.

来源