Privacy policy

How the service works

Encrypt.One is a free service for sharing passwords, keys and files through one-time links. No sign-up is needed. The service is developed and run by FINAL LEVEL.

You send the link yourself, in any way you like. A messenger, email or SMS can be intercepted, and then whoever opens the link first gets the secret. For important data, set an opening password and share it through a different channel.

Secrets and files

Text and an attached file are encrypted in your browser with AES-256-GCM through the built-in Web Crypto API before they are sent. The file name and type are encrypted together with the content.

The server stores only:

• the encrypted data;
• the expiry time;
• whether a file is attached;
• a password check hash, if you set an opening password.

The decryption key is the part of the link after the # sign. Browsers never send that part to the server, so neither we nor anyone who gains access to the server can decrypt the data. For the same reason we cannot recover a secret if the link is lost.

Opening password

The password itself never leaves your browser. From the password and the link key the browser derives two independent values: the encryption key and a check hash (PBKDF2 with 600,000 iterations, then HKDF). Only the hash is sent to the server. The server uses it to check the password but can learn neither the password nor the key.

After three wrong attempts the secret is deleted. The attempt counter is kept in the server memory and belongs to the secret, not to a visitor.

When data is deleted

• right after the recipient opens the secret;
• when you press “Destroy now” on the link page;
• after the third wrong password;
• when the chosen period ends, from 1 hour to 7 days. An expired secret is no longer served at once, and its data is wiped by the daily cleanup.

A deleted secret cannot be recovered. Messenger bots that build link previews do not use up a secret: the data is served only after “Show secret” is pressed.

Technical logs

The application server logs only API requests: the request type, the result and the processing time. IP addresses, secret ids, tokens, page addresses and request contents are never logged.

To protect the service from brute force and abuse, the server limits the request rate per IP address. The address is used only in memory and is not stored.

A web server in front of the application may keep a standard access log: IP address, time and page address without the part after #. Such logs are used only to protect against attacks and are kept for a limited time.

Cookies and browser storage

We use no advertising or analytics cookies. The site stores in your browser only what it needs to work:

• the lang cookie — your language, if you picked one in the switcher;
• in localStorage — the color theme, a note that you closed the language banner and notes about links destroyed from this browser;
• in sessionStorage — a password from the generator while it is carried over to the form on the home page. It is removed right after it is inserted.

Of these, only the language cookie reaches the server, which uses it to pick the page version. You can delete all of it in your browser settings.

Third-party services

The site loads no third-party scripts, fonts, counters or ads: everything, fonts included, is served from our own server. We do not sell or share data with third parties.

The buttons for sending via Telegram, WhatsApp and email, as well as links to sponsor sites, are plain links. An external service gets data only when you click one, and its own policy applies from then on.

Password generator

Passwords, passphrases and PINs are created in your browser with a cryptographic random number generator and are never sent to the server.

Open source

The source code is open on GitHub: you can check how the encryption works or run your own copy.

Your rights

We do not know who created or opened a secret: the service links data to no people, accounts or IP addresses. That is why we cannot find, hand over or delete the data of a particular person. To delete your secret before it expires, open the link page and press “Destroy now”.

Changes to this policy

If this policy changes, we will publish the new version on this page and update the date at the top.

Questions

Ask privacy questions in the GitHub issues.