cipher.ink
Contact

Write to us

A question, a bug, or a message that should not be here. To report a message, paste its link; the part from /m/ to the # is enough for us to remove it. Anything after the # is its key, so leave that off unless you want us to be able to read it.

This form is not encrypted. It arrives as an ordinary email.

Or write to support@cipher.ink. That is ordinary email too, and not encrypted, so keep secrets out of it.

How cipher.ink works

  1. You write. The words stay in this tab. Nothing is sent while you type.
  2. Your browser seals it. AES-256-GCM, through the browser's own Web Crypto. With a passphrase, the key comes from PBKDF2-SHA256 at 600,000 rounds with a fresh random salt. With a secret link, the key is 256 random bits.
  3. The server holds ciphertext. It never receives your words, file names, passphrase or link key. A secret link's key lives after the #, and browsers never send that part to a server.
  4. They unseal it. Their browser does the decryption. A burn-after-reading message is deleted from the server as it is handed over; its attachments can be fetched once, within 15 minutes, and no more.

Privacy

No accounts, no cookies, no trackers, no analytics, no ads, and nothing loaded from a third party. The feedback tab is the one script that comes from another address, feedback.cipher.ink, a feedback server I also run. The server does see when a message was sealed and opened, how big it is, and the passphrase hint if you write one (hints are not encrypted). Your IP address is kept only as a salted hash, for two days, to limit how many messages one connection can seal in an hour; the web host's own access logs also record it. When a message ends, its contents go at once and its timestamps after 90 days.

The feedback box is the one place that isn’t sealed: what you type there is plain text the server can read. We keep the words you type, your mood pick, the kind of page you were on (not its address), your screen size and theme, your browser, a one-way hash of your address, your country and the time. It is kept on feedback.cipher.ink, my own feedback server, not a third party’s, with no account and no email involved, until it is deleted by hand.

Messages sealed on the old cipher.ink still open with their original passphrase.

Contact, or report a message ·