Frequently asked questions

No. They are encrypted in your browser with a key that stays in the part of the link after the #. Browsers never send that part to a server.

Then it is gone for the intended recipient, and they see that the link was used up. Treat the secret as compromised, change it and send a new one. Under "Sent" you see whether and when a link was opened.

So strangers cannot use this server as a free relay. Recipients and people answering a request never need an account.

No cookies for visitors, no analytics, no external resources, and our application stores and logs no IP addresses.

You choose one hour, one day or seven days. The secret is deleted on first view, on expiry or when you withdraw the link, whichever comes first.

Yes. ExoSeal is open source under AGPL-3.0 and runs with one docker compose file and your own login provider.

AES-256-GCM, right in your browser. The key is generated randomly and lives only in the part of the link after the #. Requests additionally use a key pair whose private part stays protected by your passphrase.

No. Recipients just open the link in their browser. People answering a request do not need an account either.

You use it to ask someone to send you a secret. They answer in their browser, the answer is encrypted, and you open it with your passphrase.

Yes. When sending, you can optionally set a password. Give it to the recipient another way, for example by phone. Without the link and the password the secret cannot be opened.

Only the ciphertext lives on the server, until it is viewed for the first time, the chosen lifetime (one hour to seven days) ends or you withdraw the link. Then it is deleted. For 30 days only a note without content remains, so the link can say what happened to it.

In email and chat a password often stays readable in the history forever. An ExoSeal link works exactly once, and the server can never read the content.