PrivSend — one-time encrypted secrets

About

PrivSend sends a password, a recovery code, a document or an image — anything you would not want sitting in a chat log — as a link that works exactly once. Open it, and it is gone.

Everything is encrypted on your device before it leaves. The key never reaches the server: it lives in the part of the link after the "#", which browsers do not transmit. The server stores ciphertext it cannot read, and cannot be compelled to hand over what it does not have.

HOW YOU USE IT

1. Click the PrivSend icon in your toolbar. A compose tab opens.
2. Type your secret, and attach files if you need to.
3. Optionally add a passphrase, and choose how long the link may live — one hour, one day, or at most seven days.
4. Create the link and pass it to your recipient however you like: chat, email, read aloud on the phone. PrivSend delivers nothing for you and never asks who the recipient is.
5. They open it, click Reveal, and the secret is decrypted on their device and destroyed on ours.

If you set a passphrase, tell your recipient by a different route than the one you sent the link by. Sending both through the same chat gives an attacker who reads that chat both halves — splitting them is the whole reason a passphrase is worth having.

WHY THE EXTENSION EXISTS

The website does the same encryption — but a website is delivered by the server on every visit, so you are trusting the server to keep sending you honest code. A server that had been compromised, or compelled, could serve one targeted person a modified script.

This extension removes that. The encryption code is installed in your browser and versioned, and is never re-fetched. Both directions run from it: composing a secret, and opening one. When you click a privsend.app share link with this extension installed, the decryption happens in your installed copy — not in a page the server hands you at that moment.

A green "Running locally" banner shows you when that is what is happening.

WHAT IT DOES

• Text secrets and file attachments in one link
• An optional extra passphrase (PBKDF2, 600 000 iterations), so the link alone is not enough
• Burn on read: the secret is destroyed the first time it is successfully read, atomically — under any amount of concurrency, at most one reader ever gets it
• You choose the lifetime: one hour, one day, or at most seven days. An unread secret is destroyed when it expires
• Opening a link does not consume the secret. A human has to click "Reveal", so mail scanners, chat link-previewers and antivirus crawlers cannot burn it before your recipient arrives
• No account, no sign-up, no email address, no tracking

WHAT THE SERVER CAN AND CANNOT SEE

Never reaches it: your text, your files, their names and types, even how many there are — and the key.

It does hold, because it must: the ciphertext, a random link id and status id, a nonce and salt (neither is secret), whether a passphrase was set, each file's size in bytes, and created/expiry/opened timestamps. No identity, and no IP address, is ever stored against a secret.

OPEN SOURCE — AND IT IS THE COPY YOU RUN

The complete client is published under the GNU AGPL-3.0:
https://github.com/hannu64/privsend-client

There is no build step and no minification. The files in that repository ARE this extension — you can read every line and compare it with what you installed, with nothing in between.

PERMISSIONS

One host, privsend.app, and no other: to upload and download the encrypted blobs, and to hand share links to the installed decryption page. No analytics, no third-party scripts (a strict Content-Security-Policy forbids them), no remote code.

Made by Zumitomi Oy, Finland.
Support and security reports: [email protected]