🔐 Security & Encryption
What is AES-256-GCM and why is it the best encryption?+
AES-256-GCM is the encryption standard mandated by the US Government for top-secret data, used by the NSA, militaries, and financial institutions worldwide. With 256 bits, there are 2²⁵⁶ possible keys. Breaking it would take longer than the age of the universe even with all computers on Earth. GCM mode adds cryptographic authentication, preventing any tampering.
Is VaultSends really secure?+
Yes. All secrets are encrypted using AES-256-GCM with PBKDF2-SHA512 at 310,000 iterations before storage. Even if someone gained access to our database, they would see only encrypted ciphertext — completely unreadable without the unique encryption key.
Can VaultSends employees read my secrets?+
No. VaultSends is a zero-knowledge system. We only store AES-256-GCM ciphertext, never plaintext. Without your passphrase (which we never store), it is mathematically impossible to decrypt your secret.
Can brute force attacks expose my secret?+
Extremely unlikely. PBKDF2-SHA512 with 310,000 iterations makes each guess computationally expensive. Combined with rate limiting and IP blocking after failed attempts, brute force is practically infeasible for any strong passphrase.
👁 Privacy & Data
Does VaultSends store my secrets in plaintext?+
Never. VaultSends stores only AES-256-GCM encrypted ciphertext. Your plaintext secret is never written to disk. Your passphrase is never stored. After viewing or expiry, the data is permanently deleted.
What data does VaultSends log?+
We log minimal metadata for security: creation timestamp, expiry, view status, and IP addresses. We never log the content of your secret. IP data is stored temporarily and deleted with the secret.
Does VaultSends use cookies or tracking?+
No tracking cookies, no analytics SDKs, no third-party scripts. No Google Analytics, no Facebook pixel, no ad networks. The only external resource is Google Fonts for typography.
⚙ Features
What happens after my secret is viewed?+
The moment the secret is fetched and displayed, it is permanently and irreversibly deleted from our database. The encrypted data is overwritten with random bytes before deletion. There is no backup, no recovery option.
How does IP allowlisting work?+
When you add IPs to the allowlist, our server checks the visitor's IP on every view request before any decryption. Unauthorized IPs receive a 403 Access Denied response — they cannot see any content.
Do I need to create an account?+
No. VaultSends requires zero registration. No email, no username, no password. Simply visit vaultsends.com, paste your secret, and get a link.
What types of secrets can I share?+
Any text-based sensitive data: passwords, API keys, SSH private keys, database credentials, OTP codes, private notes, JWT tokens, environment variables, certificates, or any confidential text up to 1MB.
💼 Use Cases
Can I use VaultSends for my business or team?+
Absolutely. VaultSends is ideal for developer teams sharing credentials during onboarding, HR sharing initial passwords, devops sharing server keys, or anyone who needs to transfer sensitive data without creating a permanent record in email or messaging apps.
Is VaultSends free?+
Yes, completely free with no limits on core functionality. No plans, no premium tiers, . VaultSends is built as a public utility funded by the founder.
What if I send the link to the wrong person?+
You can destroy the secret immediately from the success screen using the "Destroy Now" button before they open it. Once destroyed, the link becomes invalid. Always use a passphrase for highly sensitive secrets.