Public
E2E encrypted secret sharing with expiring links
Val Town is a collaborative website to build and scale JavaScript apps.
Deploy APIs, crons, & store data – all from the browser, and deployed in milliseconds.
Send passwords, API keys, and sensitive text to anyone. Your secret contents are encrypted in your browser via a passphrase which never leaves your device.
The code for this service is 100% open-source on Val Town, so you can audit it and trust we're not doing any monkey business with your secrets. What you see at val.town/x/stevekrouse/secret-share is exactly what runs when you use the app.
Rendering mermaid diagram...
secret-share/
├── main.ts # Hono app — mounts API + serves static + SPA shell
├── server/
│ ├── db.ts # SQLite CRUD (stores only ciphertext + proof)
│ ├── rateLimit.ts # In-memory per-IP token-bucket middleware
│ ├── validate.ts # UUID + base64 input validation
│ └── api.ts # POST / GET / DELETE /api/secrets
├── frontend/
│ ├── index.html # Static page shell
│ ├── index.tsx # Client-side React mount; reads window.location.pathname
│ └── components/
│ └── App.tsx # CreateView + RevealView
└── shared/
├── types.ts # Shared TypeScript interfaces
└── crypto.ts # AES-256-GCM + delete-proof derivation