Security Architecture

Built to Be Trustworthy

Not by promise — by design. Here's exactly how your data is protected.

// ENCRYPTION_SPEC

security.config

Algorithm: AES-256-GCM (authenticated encryption) Key Size: 256 bits (2²⁵⁶ possible keys — unbreakable) Auth Tag: 128 bits (prevents tampering) IV Size: 128 bits (random per secret) Salt: 256 bits (random per secret) KDF: PBKDF2-SHA512 KDF Iters: 310,000 (NIST 2023 recommended minimum) Storage: Ciphertext only — NEVER plaintext Zero-Knowledge: Server CANNOT decrypt without passphrase Transport: HTTPS / TLS 1.3

// THREAT_MODEL

Database breach — encrypted data only, unusable without master key

Network interception — HTTPS/TLS in transit, AES-256-GCM at rest

Brute force passphrase — rate limiting + PBKDF2-SHA512 at 310K iterations

Replay attacks — each secret has unique salt + IV, auth tag prevents reuse

Data tampering — GCM auth tag rejects any modified ciphertext

Timing attacks — timing-safe comparison for passphrase verification

Unauthorized IP access — allowlist enforced before decryption

Malicious insider — we cannot see plaintext, but we control the server

Phishing attacks — always verify you're on vaultsends.com

Compromised endpoint — we cannot protect against keyloggers on your device

// DATA_STORED

Data	Stored	Notes
Secret content	Encrypted only	AES-256-GCM ciphertext — unreadable without key
Your passphrase	Never stored	Only PBKDF2 hash for verification
Creator IP address	Stored temporarily	Deleted permanently with the secret
Viewer IP address	In access log	Logged for security, deleted with secret
User accounts	None	No registration, no profiles, no personal data

// BEST_PRACTICES

DO ✓

→Use a strong passphrase for sensitive data

→Share passphrase via a different channel

→Set short expiry for highly sensitive data

→Enable notifications to know when viewed

→Destroy the secret if sent to wrong person

DON'T ✕

→Share secret link in public channels

→Screenshot content on shared devices

→Use same passphrase as the secret itself

→Set high view count for one-time credentials

→Rely on VaultSends alone for mission-critical access

Create a Secure Secret →