PrivSend — encrypted one-time secrets & files

PrivSend does two things, and both of them encrypt on your device.

SEND a password, a recovery code, a document or an image — anything you would not want sitting in a chat log — as a link that works exactly once. Open it, and it is gone.

RECEIVE with a drop address: a link you can publish or hand out, that lets anyone send you an encrypted message and files without an account. Only you can read what arrives.

The key never reaches the server. On a share link it lives in the part after the "#", which browsers do not transmit. On a drop, every message is sealed to your public key, and the private half is unwrapped only by your passphrase, in your browser. The server stores ciphertext it cannot read, and cannot be compelled to hand over what it does not have.

HOW YOU SEND

1. Click the PrivSend icon in your toolbar. A compose tab opens.
2. Type your secret, and attach files if you need to — up to ten, 25 MB each.
3. Optionally add a passphrase, and choose how long the link may live: four hours, one day, or at most seven days.
4. Create the link and pass it to your recipient however you like: chat, email, read aloud on the phone. PrivSend delivers nothing for you and never asks who the recipient is.
5. They open it, click Reveal, and the secret is decrypted on their device and destroyed on ours.

If you set a passphrase, tell your recipient by a different route than the one you sent the link by. Sending both through the same chat gives an attacker who reads that chat both halves — splitting them is the whole reason a passphrase is worth having.

HOW YOU RECEIVE — DROP ADDRESSES

1. Create a drop address and choose a passphrase. It protects your inbox and is your only key: it never reaches the server, and it cannot be reset.
2. You get two links: a public one to hand out or publish, and a private console link that opens your inbox. Keep the second to yourself.
3. Anyone holding the public link can write to you and attach files, with no account and nothing to install.
4. Unlock your inbox with your passphrase to read what arrived. Messages stay until you delete them or the retention you chose runs out — 7, 14 or 30 days.

A drop address is the mirror image of a share link. A share link is one-time and burns on read; a drop inbox is yours to keep, and drop files can be downloaded again.

WHY THE EXTENSION EXISTS

The website does the same encryption — but a website is delivered by the server on every visit, so you are trusting the server to keep sending you honest code. A server that had been compromised, or compelled, could serve one targeted person a modified script.

This extension removes that. The encryption code is installed in your browser and versioned, and is never re-fetched. Every page that touches a key runs from it: composing a secret, opening one, writing to a drop address, and your own inbox. Open a privsend.app link with this installed and the extension takes over, however you arrived — a bookmark, a search result, a link from a friend.

A green "Running locally" banner shows you when that is what is happening.

WHAT IT DOES

• Text and file attachments in both directions — up to ten files, 25 MB each • Share links burn on read: destroyed the first time they are successfully read, atomically — under any amount of concurrency, at most one reader ever gets it • You choose the lifetime: four hours, one day, or at most seven days. An unread secret is destroyed when it expires • Drop addresses for receiving: anonymous senders, no account on either side, retention you control • An optional extra passphrase on a share link (PBKDF2-HMAC-SHA-256, 600 000 iterations), so the link alone is not enough • Drops are sealed with ECDH on P-256, HKDF-SHA-256 and AES-256-GCM — the browser's own WebCrypto throughout, nothing hand-rolled, no third-party library • Opening a share link does not consume the secret. A human has to click "Reveal", so mail scanners, chat link-previewers and antivirus crawlers cannot burn it before your recipient arrives • English and Finnish, switchable on every page • No account, no sign-up, no email address, no tracking

WHAT THE SERVER CAN AND CANNOT SEE

Never reaches it: your text, your files, and their names and types — and the key.

It does hold, because it must: the ciphertext, random ids, a nonce and salt (neither is secret), whether a passphrase was set, how many files there are and each one's size in bytes, and created, expiry and opened timestamps. No identity, and no IP address, is ever stored against a secret or a drop message.

OPEN SOURCE — AND IT IS THE COPY YOU RUN

The complete client is published under the GNU AGPL-3.0: https://github.com/hannu64/privsend-client

There is no build step and no minification. The files in that repository ARE this extension — you can read every line and compare it with what you installed, with nothing in between.

PERMISSIONS

One host, privsend.app, and no other: to upload and download the encrypted blobs, and to hand privsend.app links to the installed pages that decrypt them. No analytics, no third-party scripts (a strict Content-Security-Policy forbids them), no remote code.

Made by Zumitomi Oy, Finland. Support and security reports: support@zumitomi.fi