Send an encrypted message
Create a temporary zero-knowledge link for confidential messages. Encryption happens in your browser; the key stays in the URL fragment and is never sent to the server.
What zero-knowledge gives you
- Only sender and recipient can read it
- Read-once link that self-destructs
- No traces in chats or inboxes
- Verify with F12 that the key stays local
What happens to your message, step by step
When you type a message, nothing leaves the tab until you ask for a link. At that point the browser generates a random key, encrypts your text with AES-256-GCM, and uploads only the resulting ciphertext. The key is appended to the link you get back, behind the # character.
Because browsers treat everything after the # as a client-side fragment, that key is never included in the HTTP request. The server stores an encrypted object and a short identifier, and it has no path back to your plaintext — not under load, not on request, not by an administrator poking at the database.
The recipient's browser does the reverse: it reads the key out of the fragment, fetches the ciphertext, and decrypts locally. After that first successful read the stored object is deleted. If nobody ever opens the link, the expiry you chose removes it anyway.
Frequently asked questions
Can the operator read my message?
No. Encryption happens in your browser and the server only stores ciphertext. Without the key from the URL fragment nobody — not even the operator — can read it.
What happens after reading?
Once decrypted, the server permanently deletes the encrypted data. The one-time link no longer works.
Related pages
Open the secure app at pcpx.one and create your encrypted link.