Encrypted notes and files that self-destruct
Klassified sends a note or a file that encrypts in your browser, opens once, and leaves
no readable copy behind. The server receives ciphertext and an opaque identifier. It
never receives the decryption key, so it cannot open what it stores even under legal
compulsion.
What happens when you send one
- Your browser generates a random 128-bit secret and derives an AES-256-GCM key from
it. Nothing has left the tab yet.
- The ciphertext is uploaded and stored under a 12-character identifier with the
expiry you chose. The key is placed after the
# in your link, which
browsers never send to a server. - Your recipient opens the link once. The stored copy is deleted and decryption
happens in their browser.
The exact parameters are published on the security page, and
the request flow, including its failure modes, on
how it works.
What the server never receives
- The decryption key, which lives only in the link fragment.
- The note text, the file contents, or the file name.
- Who sent or received a note: notes need no account. File shares are sent from a verified
account, so we know which account created one, but never who received it.
What it does see is the size of the ciphertext, when a share was created, expired or
read, and whether a password was set. That is not nothing, and pretending otherwise
would be dishonest.
Limits worth knowing before you rely on it
- A share lives between 5 minutes and 24 hours, then expires whether
or not anyone opened it.
- Notes are capped around 200 KB of ciphertext. Files default to
10 MB and need an account with a verified email address; notes do
not.
- One-time delivery is a strong default, not a transactional guarantee, and an
automated link scanner can be the first reader.
- Nothing is recoverable. A lost link or forgotten password means the content is gone,
including for us.