What's New

Release notes & changelog · SafeDrop by AuthTech.io

v0.1 Initial release 19 June 2026

The first public release of SafeDrop — a zero-knowledge tool to send and store secrets that the server can never read.

Core security model

Zero-knowledge / end-to-end: all encryption and decryption happen in your browser via the Web Crypto API. The server only ever stores opaque ciphertext — it never sees your passphrase, PIN, or plaintext.
Two factors required: every secret is protected by a passphrase plus a 6-digit PIN. Both are needed to unlock, and neither is stored or transmitted.
HTTPS only, with a strict content-security policy and no third-party scripts or trackers.

Two-layer envelope: your text is first encrypted with a random 1024-bit key under one of 10 authenticated ciphers chosen at random — then that bundle is sealed again with a key derived from your passphrase + PIN.
10 AEAD ciphers: AES-256/128-GCM and AES-256/128-CTR & AES-256-CBC paired with HMAC-SHA-256/384/512 (encrypt-then-MAC). All authenticated; no weak modes.
Strong key derivation: PBKDF2-SHA-256 at 600,000 iterations, HKDF-split into the storage address and the wrapping key — so the lookup hash can't be attacked faster than the ciphertext itself.

Wrong credentials reveal nothing: an incorrect passphrase or PIN simply lands on an empty address — no hint that anything exists.
Retrieve & destroy: decrypt with the same credentials, then click the revealed text to permanently wipe it from the server. A Copy button is provided.

Lock to this machine: bind a secret to the device that created it — it can only be decrypted on that same machine.
Decrypt once: the secret auto-deletes from the server the moment it is first successfully read (burn-after-reading).

Self-hosted captcha on both storing and retrieving — no external captcha services.
Per-machine lockout: 5 failed attempts lock that device for 30 minutes (identified by a device token + browser fingerprint, not by IP).
Nothing persisted: input fields are wiped on every load, refresh, and back-navigation; secrets are never written to storage or logs; no-cache headers throughout.
Dark / light theme toggle.

A stolen ciphertext blob can be brute-forced offline, so choose a strong passphrase — the deliberately slow key derivation is your defense there.
"Lock to this machine" relies on a browser token + fingerprint; clearing site data or a major browser/OS change can make a machine-locked secret unrecoverable.
Re-saving with the same passphrase + PIN overwrites the previous secret, without a warning.