Zero-Knowledge Ephemeral Secret Sharing
Calypso is a high-utility, developer-first tool designed for founders, engineers, and creators to share sensitive credentials, environment files, and one-time passwords without leaking them to persistent chat history, database logs, or server storage.
Client-Side E2EE
Encryption happens directly in your browser using the native Web Crypto API. The encryption key resides strictly in the URL hash (#key=...) and is never transmitted over HTTP to our servers.
Bot & Crawler Shield
Automated link scrapers from Slack, Discord, WhatsApp, and Twitter are recognized and served preview metadata without decrypting your payload or decrementing the view counter.
Cryptographic Shredding
Once consumed or expired, ciphertext rows are overwritten with random entropy before deletion. Senders also receive a 32-character destruction token to revoke links remotely at any time.
How the Architecture Works
Browser Encryption
When creating a secret, your browser generates a random 256-bit key and 96-bit IV, encrypting the plaintext into an opaque AES-GCM ciphertext package before making a POST request.
Fragment Key Distribution
The shareable link places the key behind an RFC 3986 fragment (#key=...). Because URL hash fragments are client-only, web proxies and server logs never receive the key.
Reveal & Shred
The recipient clicks "Reveal Secret", the client imports the key from the hash to decrypt in memory, and the backend permanently overwrites and deletes the record from the database.
Technical Specification
Built to modern cryptographic standards for zero-trust workflows.
| Parameter | Implementation Detail |
|---|---|
| Encryption Algorithm | AES-GCM-256 (Galois/Counter Mode with 96-bit IV) |
| Key Distribution | Client-Side URL Hash Fragment (RFC 3986 §3.5) |
| Server Knowledge | Zero-Knowledge. Plaintext & decryption key never touch server disk or RAM. |
| Link Pre-fetch Protection | User-Agent detection for Slack, Discord, Teams, WhatsApp, Twitter, Telegram, etc. |
| Shredding Mechanism | Overwritten with 64 random alphanumeric bytes before soft & force purge. |
| Sender Revocation | 32-character destroy_token validated via timing-safe hash_equals. |
| Privacy & Logging | GDPR compliant: IPv4 masked to /24 subnet, IPv6 masked to /64 subnet. |
| REST API | Available at /api/v1/secrets with JSON responses and automated destruction. |
Frequently Asked Questions
Clear, transparent answers on privacy, mechanics, and security.
#key=...). Because web browsers never send hash fragments to web servers in HTTP requests, our backend and database only ever see an encrypted blob without the key.
php artisan secrets:purge) runs every 10 minutes to permanently force-delete all shredded records.
/api/v1/secrets. You can POST JSON payloads to generate one-time secrets and receive the share URL and destroy_token for automated workflows. Refer to /llms-full.txt for the API schema.
Maintained by OBILODEV
Calypso was built as an internal security utility for engineers, founders, and creators. For security disclosures, questions, feature requests, or enterprise deployment inquiries, reach out directly: