cipher.ink by the numbers

cipher.ink is small enough that its important properties fit in a list of numbers. Each one below is read from the code or measured by a script, not typed in, and each links to the article that explains why it has that value. We'll brag about what the product is. We won't publish how much it's used: there are no message counts, visitor counts or growth figures anywhere on this site, because we don't think they're anyone's business.

The lock

Every message gets a 256-bit key, a random 96-bit IV and a 128-bit tag. A passphrase is stretched with 600,000 rounds of PBKDF2 and a 16-byte random salt, so a guess costs about a million times what a plain hash would. The identifiers that name a message are 70 bits, far too many to guess. None of these numbers was picked to impress anyone. Each is what the standards recommend or what the code needs, and AES-GCM, explained and the PBKDF2 article say why.

Privacy

The page makes no requests to other sites (the feedback tab comes from feedback.cipher.ink, which I also run), sets no cookies and loads two libraries, both self-hosted. When a message ends, the server keeps its timestamps (never its content) for 90 days. That tombstone, and everything else the server keeps, is listed on the security page.

The code and its checks

The compose page runs 147 KB of plain, unminified JavaScript you can read on the code page, and the cryptography is a single file. 930 automated checks cover it, including 423 official known-answer test vectors that the tools have to reproduce exactly. The old format still opens 81 messages from before 2026, byte for byte against the library that made them (how).

Speed

The front page transfers 372 KB, fonts and all, compressed. In a headless-Chrome benchmark on a busy laptop, a keystroke takes a median of 210 ms to reach the screen, about what a completely bare text box takes on the same machine (the page was 1 % slower than a bare one in that run). The first 2026 build had full-screen blurred effects behind the page and took 800 to 2,500 milliseconds. The rule that came out of it is no blur, blend or animation behind the text, and a benchmark in the project checks it. scripts/measure-facts.mjs and the tests produce these figures, and they're re-measured whenever the pages change.

Our Secret Santa takes up to 60 people and deletes the whole exchange 30 days after the gift date, never more than 120 days after the draw. Pulling names from a hat with 10 people goes wrong 63% of the time; the reason is on the Secret Santa math page. Like every number here, none of these says how many people use it.

The history of cipher.ink tells the rest of the story.