Itomic Utilities

Secret Share

Create a short-lived secret link.

Encrypt sensitive text in your browser and share a link that expires by time or view count. The decryption key stays in the URL fragment and is not sent to the server.

Expires after
View limit

The secret is permanently deleted when either limit is reached, whichever comes first: the time expiry or the view count.

The minimum is 2 views because some mail, chat, or ticket systems may preview a link before the person opens it.

Secrets are encrypted before upload with AES-GCM. Expired, viewed-out, or burned records are deleted by scheduled cleanup.

How this stays private

Your browser encrypts the secret before upload

The plain text is turned into encrypted ciphertext on your device. The server receives only that encrypted blob and a random nonce.

The decryption key is kept out of our systems

The key is stored after the # in the share URL. Browsers do not send that fragment to the server, so Itomic cannot use the database record alone to read the secret.

Access is deliberately short-lived

Each secret expires by time and by view count. Once either limit is reached, the secret is no longer available.

The full link is the secret

Anyone who receives the complete URL, including the #key=... part, can decrypt it until it expires or is burned. Share it only through a channel you trust.

Technical details

  • Encryption and decryption use the browser Web Crypto API in a secure context. If the required browser crypto, encoding, or temporary key storage features are unavailable, creation is disabled before upload.
  • Each secret gets a fresh 256-bit AES-GCM key and a fresh 96-bit random nonce. The server receives the ciphertext and nonce, not the plain text.
  • The share URL contains two parts: a random server lookup token in the path, and the AES key after #key=. The fragment is handled by the browser and is not submitted to the server in the create, reveal, or burn requests.
  • The server stores an HMAC-SHA-256 hash of the lookup token, enforces expiry and view limits, and locks the database row while a reveal consumes a view.
  • Expired, burned, and viewed-out records are purged by scheduled cleanup. Secret reveal pages are marked noindex, nofollow.
  • Security headers restrict where scripts, forms, fonts, images, frames, and network calls can come from. Material Symbols are self-hosted so this page does not need Google-hosted font requests.