Security
What LegacySafe guarantees — and what it cannot do, by design.
We cannot read your secrets
Encryption (AES-256-GCM) happens in your browser, before anything goes over the network. The key, drawn at random for each secret, is placed in the link's fragment — the part after the “#”, which browsers never send to a server. Our database holds nothing but ciphertext we have no key for.
A password adds a second lock
You can put an optional password on a secret. The text is then wrapped by a key derived from that password (PBKDF2-SHA256, 600,000 iterations) before the link's own key is applied — so a leaked link is not enough to read it. Send the password through a different channel from the link. We never receive it, which also means nobody can reset it: if it is lost, the secret is unrecoverable.
Destruction is permanent
Reading a secret deletes the database row in the same operation: two people cannot read the same link. No trash, no backup of the content. A secret that is never read is destroyed at its expiry. With an account, you can also revoke it beforehand.
Links cannot be guessed
Every secret gets a random identifier (UUID v4), never a counter. Both creation and reading are rate-limited per IP address, which makes scanning pointless.
What your browser keeps
If you have an account, the key of a link you create is kept in that browser's local storage — that is what lets you recover the link from “My links”. It is never sent to our servers, and it is erased as soon as the secret is read, expired or revoked. On a shared machine, be aware that someone with access to your session could rebuild the links of your unread secrets.
The log records no content
For secrets created from an account, every creation, read, expiry and revocation is recorded with its date and its author — metadata, never the secret itself, not even encrypted. No content reaches our application logs or our error-tracking tools.
Two habits worth keeping
- Pick the shortest expiry your recipient can work with.
- If a link may have been seen by the wrong person, revoke it and rotate the secret it held.