How I built a zero-knowledge, self-destructing secret sharing tool

#opensource #privacy #security #webdev

Most of us have pasted a password or API key into Slack or email because it was the quickest option. That message then sits in search indexes, backups, and inboxes, often long after anyone needs it.

Privnote and OneTimeSecret exist for this. I wanted one where the server can't read the secret at all, so I built VanishShare: encrypted, self-destructing notes and small files.

The key never leaves the browser

When you create a secret, the browser does the work:

Generate a random 256-bit AES key with the Web Crypto API
Encrypt the note or file with AES-256-GCM
Send only the ciphertext to the server
Put the key in the link's hash fragment (#...)

// Generate a key and encrypt in the browser
const key = await crypto.subtle.generateKey(
  { name: "AES-GCM", length: 256 },
  true,
  ["encrypt", "decrypt"]
);

const iv = crypto.getRandomValues(new Uint8Array(12));
const ciphertext = await crypto.subtle.encrypt(
  { name: "AES-GCM", iv },
  key,
  new TextEncoder().encode(secret)
);

Why the hash fragment matters

Browsers leave everything after # out of HTTP requests. A link like this:

https://vanishshare.app/s/abc123#<decryption-key>

sends only /s/abc123 to the server. The key stays on the sender's and recipient's devices, and the server stores ciphertext it can't decrypt.

Self-destruction

Each secret expires after 10 minutes, 1 day, 1 week or 1 month, and you can cap it at 1, 5, 10 or 20 views or leave views unlimited. Once a secret expires or hits its limit, the server deletes the encrypted payload.

Optional protections

You can add a passphrase and share it through a different channel, so a leaked link alone isn't enough. You can also require recipients to verify their email with a one-time code. Files up to 200KB work too (certificates, private keys, small documents) and get the same browser-side encryption. There's also an API and CLI for scripting.

Limitations

The server still sees metadata, such as when a secret was created, its size and when it was opened. Like any web app, VanishShare relies on you trusting the JavaScript the server delivers. It's meant for temporary secrets. Long-term storage belongs in a password manager.

Try it

Live: vanishshare.app
Algorithm Review Code: github.com/pradeepsng30/vanishshare-sec
API docs: vanishshare.app/docs/api

Feedback on the threat model and the crypto design is especially welcome. If you find a flaw, please open an issue.

DEV Community