Questions & answers

Does anything I encrypt get uploaded?

No. Text and file encryption happen entirely in your browser. The only feature that sends anything is the one-time secret — and it uploads only ciphertext the server can't read, never your key or plaintext.

If it's all client-side, why should I trust this website?

You shouldn't have to — and we mean that literally. Client-side encryption still means trusting the JavaScript our server sends on every visit; a compromised or coerced server could ship altered code and you'd never see it. That's why our standing recommendation is to download the offline app once — a single file you can verify by checksum and keep forever — or run your own copy from source, and treat this hosted page as the convenience option for low-stakes use. The formats are identical either way.

Can you recover my passphrase or decrypt something for me?

No, and that's the point. We never receive your passphrase or keys, so there's nothing on our end to recover from. If you lose the passphrase or a private key, the data it protected can't be opened by anyone — including us.

How strong is the encryption?

Passphrase locking uses AES-256-GCM with PBKDF2 key stretching (250,000 iterations of SHA-256). Public-key messages use ECDH on curve P-256 into AES-256-GCM. These are standard, widely-audited primitives — the same class of cryptography behind HTTPS and password managers. The full method is on the How it works page.

How is a one-time secret different from just encrypting text?

Convenience and self-destruction. With a one-time secret there's no separate passphrase to deliver — the link is the secret — and it deletes itself after it's read, so it doesn't linger in an inbox or chat history. Use passphrase encryption when you want the recipient to keep the data; use a one-time secret to hand something over and have it disappear.

Could a link preview or chat app burn my secret before it's read?

No. Opening a one-time-secret link doesn't reveal anything automatically — the recipient has to click "Reveal the secret" first. Automated link unfurlers never take that step, so the secret survives for the human.

What's the largest file I can encrypt?

There's no fixed limit anymore. Files are encrypted in 4 MB pieces, so even multi-gigabyte files work; in Chrome and Edge the result also streams straight to disk instead of filling memory. The encrypted container hides the original filename too, and restores it when decrypting.

What happens to my encrypted files if this site shuts down?

Nothing — they stay yours to open. Encryption happens on your device, so decryption never needed our server in the first place. To make that concrete, the Source & offline app page gives you a single-file offline app to keep with your backups, the full source code (MIT licensed) with instructions to run your own copy, a command-line tool, and a byte-exact format spec anyone can reimplement. The original version of this app is also kept frozen at /files/encrypt/legacy/. The one exception is one-time secret links: they live on the server and burn after reading — by design, they don't outlive it.

Does the recipient need an account, or this site, to decrypt?

No account, ever. To open passphrase or public-key output they can use the matching tool here, the downloadable offline app, or the command-line tool — the container formats are fully documented, so nothing is locked to us. A one-time-secret link decrypts itself when opened.

Can I use this to hide illegal activity?

No. Encryption here exists to protect ordinary people's privacy and security. It isn't a shield for anything unlawful, and misuse isn't welcome. Our design keeps us from seeing your content — which also means we can't and won't manufacture it, but we cooperate with valid legal process to the minimal extent our architecture allows.

Is this related to the rest of Domainless?

Yes — it's part of the same privacy toolkit as the VPN, private search, and data removal. Encryption hides the content of what you store and send; those tools cover the connection, your searches, and your exposure. Together they're the point of J&G Studios: privacy tools run by a person, not sold by a broker.