How this works

SendPass is built so that even whoever runs this server cannot read the secrets that pass through it. Here's exactly what that means and why.

✓ This connection is encrypted (HTTPS)

The link is the key

When you create a secret, the server generates a long random token and uses it to encrypt your text. That same token becomes part of your one-time link. The server only ever stores the encrypted secret and a one-way hash of the token, used to look up the right row — never the token itself, and never anything the encryption key could be reconstructed from. Anyone with access to the database, including us, sees only ciphertext. Without the link, it's unreadable.

An optional password adds a second lock

If you set a password when creating the link, it's mixed into the same key derivation as the token — decrypting then requires both the link and the password. The password is never stored, in any form. A wrong password doesn't produce an error message pulled from a database; it produces the wrong decryption key, which fails on its own. Send the password to your recipient through a different channel than the link (a text message, a phone call — not the same email or chat as the link itself).

Read once, then gone

The first successful decryption permanently deletes the secret from the database, in the same step that reveals it — there's no window where it exists both read and retrievable. If it's never opened, it's deleted automatically once its expiry passes (checked every 5 minutes). A wrong password does not delete anything, so a mistyped password can be retried.

Guessing is rate-limited

Attempts to open a link are capped per IP address, so trying to brute-force a token or password is impractical long before it becomes a serious threat — the token alone is a 256-bit random value, far beyond what rate-limited guessing could ever reach.

Nothing sensitive is logged

This application does not log tokens or secret content, anywhere, under any circumstances. An invalid, expired, or already-used link produces the same generic message as a wrong password — the response never reveals which one it actually was.

No accounts, no tracking

There's nothing to sign up for. No analytics, no tracking scripts, no cookies beyond what a plain form submission needs. The only thing stored is the encrypted secret itself, until it's read or it expires.