Retrieve Encrypted Secret

Enter the token and the passphrase. The secret is decrypted in your browser with your private key and the passphrase together.

Quantum ML-KEM-768

The passphrase the sender gave you. It works together with your private key: neither opens the secret alone.

How a one-time secret is opened

  1. Paste the token or the link

    Paste the token you were sent, or the whole /secret/… link: the page extracts the token.

  2. Enter the passphrase

    The sender should have given it to you through another channel. We do not store it, so it cannot be recovered.

  3. Unlock your vault

    The secret is sealed to your ML-KEM-768 public key. Your vault opens it with your private key and it is decrypted in your browser.

  4. Check who signed it

    If it is signed with ML-DSA-65, you see which contact the signature belongs to: green if you have verified their fingerprints, amber if not, or if the key belongs to no contact.

Opening a secret: FAQ

How many times can I open the secret?
As many as the sender chose (1, 3, 5 or 10), and only until it expires. After that the server deletes it and there is no way to recover it.
Does the server see the secret when I open it?
No. Your browser downloads the ciphertext and decrypts it locally. The passphrase and your private key never leave your device.
What is the signature for?
The ML-DSA-65 signature proves that the secret was created by whoever holds that private key and that nobody changed it on the way. Your public key is public: without a signature, anyone could have sent you the secret.
What does "fingerprint not verified" mean?
That the signature is valid and the key belongs to one of your contacts, but you have not compared their fingerprints with that person over another channel. Do so and mark them as verified in your vault.