Why is this safer than email or Slack?

Email and Slack store your secret in plaintext on their servers, in message logs, in archives, and on every device that ever opened the conversation. Vaulted stores only encrypted ciphertext, deletes it after the view limit is hit, and the decryption key never reaches our server — so a server breach exposes nothing readable.

What happens if Vaulted gets hacked?

An attacker would only see encrypted blobs. The AES-256-GCM key never touches our servers — it lives in the URL fragment (the part after the # in the link), which browsers explicitly never send in HTTP requests. Without the key from the link, the ciphertext is useless.

Why is the key stored in the URL fragment?

The fragment (everything after #) is a client-only part of the URL defined in RFC 3986. Browsers never include it in HTTP requests, so the encryption key only lives on the sender’s machine and the recipient’s machine — never on a server, never in our access logs, never in CDN caches.

Is Vaulted open source? Can I verify the encryption myself?

Yes. The encryption code runs entirely in your browser and you can inspect it via DevTools, or follow our 5-minute verification guide to confirm no plaintext is sent over the wire. The CLI, GitHub Action, and MCP server are all open source on github.com/vaulted-fyi.

What if the recipient never opens the link?

The secret auto-expires after the time you set (up to 30 days), at which point it is deleted from Redis. View counts are also enforced atomically — once the limit is hit, the ciphertext is removed regardless of expiry.

Cara kerjanya

Enkripsi end-to-end dalam empat langkah, lalu demo langsung tentang apa yang sebenarnya dilihat server kami. Aktifkan diagram di bawah untuk detail teknis.

Pengirim

Mengetik rahasia

Browser mengenkripsi

AES-256-GCM

Server menyimpan

Hanya blob terenkripsi

Penerima mendekripsi

Kunci dari fragmen URL

Enkripsi terjadi di browsermu — server tidak pernah melihat plaintext.

Kunci ada di fragmen URL (#). Fragmen tidak pernah dikirim ke server.

Atur batas tampilan dan kedaluwarsa. Setelah tercapai, rahasia dihapus secara permanen.

Lihat enkripsi zero-knowledge secara langsung

Ketik teks apa saja, enkripsi di browsermu, lalu alihkan tampilan untuk melihat apa yang benar-benar diterima server kami. Plaintext dan kunci tidak pernah meninggalkan halaman ini.

Plaintext (dienkripsi secara lokal dengan AES-256-GCM)

Yang dilihat browsermu

Plaintext

Kunci enkripsi (base64url)

Ciphertext (base64url)

Enkripsi berjalan di browsermu melalui Web Crypto API. Balik toggle untuk melihat versi tersensor yang benar-benar diterima server kami.

Ingin panduan langkah demi langkah yang lengkap?

Buka encryption playground lengkap →

Ingin tahu lebih lanjut?

Baca panduan visual enkripsi end-to-end kami — dengan demo interaktif, perbandingan jenis enkripsi, dan FAQ.

Pertanyaan yang sering diajukan

Buat rahasia →

Cara kerjanya

Lihat enkripsi zero-knowledge secara langsung

Pertanyaan yang sering diajukan

Mengapa ini lebih aman daripada email atau Slack?

Apa yang terjadi jika Vaulted diretas?

Mengapa kunci disimpan di fragmen URL?

Apakah Vaulted open source? Bisakah saya memverifikasi enkripsinya sendiri?

Bagaimana jika penerima tidak pernah membuka tautannya?