Cryptr
Your secret · text or files · end-to-end encrypted

Share a secret, or a file, only your recipient can open

Text, credentials, documents: encrypted in your browser with AES-256-GCM before they leave it. We only ever receive the ciphertext — never the key.

AES-256-GCM End-to-end encrypted Burn after reading
  1. 01 Write your secret or add files — encrypted in your browser with a fresh 256-bit key before anything is sent.
  2. 02 Share the link and the key — by default through two different channels, so one leaked message is not enough.
  3. 03 Read once, then it's gone — your recipient's browser decrypts it with the key; the ciphertext is deleted as it is delivered.
no account required
New secret · key separate
Secret type
Encrypted in your browser · AES-256-GCM · key never sent 0 / 272 bytes
Expires after
Views allowed Soon

Expires after 1 hour · 1 view · key sent separately

Key never sent

Encrypted in your browser

Every secret gets its own random 256-bit key, generated in your browser. Only the ciphertext reaches us: the key stays with you and your recipient.

AES-256-GCM 256-bit key End to end
Two channels

Link and key apart

By default, the link alone reveals nothing: send it and the key through two different channels, so a single leaked message is not enough. A quick link carries the key inside, after # — convenient, but whoever holds the link can open the secret.

Link + key Separate by default
Self-destruct

Self-destruction on your terms

One hour, one day or one week. The secret is deleted once viewed or when it expires, whichever comes first.

TTL Burn after reading
Under the hood

What we keep — and what we never see

Your browser encrypts the secret before sending it. We store the ciphertext, its lifetime, and a fingerprint that lets us check the key without knowing it. For files, we also keep their count and sizes; names and types are encrypted with the content.

  1. 01 Encrypted in your browser — with AES-256-GCM and a fresh 256-bit key, before anything is sent to us.
  2. 02 Key never sent — we keep only the ciphertext, its IVs and tags and a hash of a token derived from the key — and, for files, their count and sizes.
  3. 03 Bound to its link — the secret id is authenticated together with the ciphertext, so it cannot be swapped.
  4. 04 Deleted on delivery or on expiry — the ciphertext is destroyed as it is delivered to your recipient, or when the lifetime ends.
  5. 05 Verifiable — architecture, audits and processing details are in the Trust Center.
Read the Trust Center
Your browser encrypts the secret and sends only the ciphertext to Cryptr, which stores it. The recipient's browser decrypts it once, with the key. YOU plaintext AES-256-GCM CRYPTR ciphertext only stored · ttl key never sent RECIPIENT link + key decrypt once KEY · YOUR OWN CHANNEL never sent to Cryptr 01 encrypt · send 02 store · ttl 03 decrypt · delete CRYPTR SHARE · FLOW ÉCH. 1:1

End-to-end encryption protects what we store and what crosses our servers. It relies on the code of this page, which we serve: a compromised server could serve altered code. Your device and its browser extensions are part of the trust too.