How FlashPaper Works

Think of it like putting your message in an unbreakable safe. Your browser uses AES-256 encryption (the same standard banks and governments use) to lock your message before sending it to us. We only store the encrypted data—never the key. The key stays with you, hidden in the link.

It means we literally cannot read your secrets, even if we tried. The decryption key is stored in the URL fragment (the part after the '#'), which your browser never sends to our servers. It's like mailing a locked box where only you and your recipient have the key.

The moment someone opens your secret (or the expiration time passes), we permanently delete it from our database. A background cleanup process double-checks that nothing remains. Once erased, the data is cryptographically unrecoverable—gone forever.

Yes. All encryption happens client-side (on your device) using the Web Crypto API before anything reaches our servers. You're not trusting us—you're trusting proven cryptographic standards. Our code is open source, we store no logs, and we don't track IP addresses.

The secret is permanently lost. Since the decryption key only exists in that link and we never store it, there's no way for anyone—including us—to recover your message. That's the trade-off for true end-to-end privacy.