Frequently asked questions
Everything you need to know
Questions about how GloriaCrypt encrypts, stores, and deletes your secrets.
Can GloriaCrypt read my secrets?
No. Your secret is encrypted in your browser before it's sent anywhere. The server only receives and stores unreadable ciphertext. The decryption key lives in the URL fragment — a part of the URL that browsers never transmit to servers. It is technically impossible for GloriaCrypt to read your secret.
What happens after the secret is opened?
The secret is permanently and immediately deleted from the server the moment it is decrypted. The link becomes dead. Even if someone obtains the same URL afterwards, there is nothing to retrieve.
What if the link expires before anyone opens it?
Secrets with a TTL (time-to-live) are automatically purged once the expiry time passes. The encrypted data is deleted from the database and the link returns a 404. You can set TTLs from 5 minutes up to 7 days.
Can I password-protect a secret?
Yes. You can add an optional password when creating a secret. The password is used to derive an additional encryption key via PBKDF2 with 600,000 iterations, adding a second layer of protection. Even if someone intercepts the link, they cannot read the secret without the password.
What encryption does GloriaCrypt use?
AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode). It is an authenticated encryption algorithm — the same used by banks, governments, and TLS. Encryption runs entirely in the browser via the Web Crypto API.
Does the decryption key ever reach the server?
No. The decryption key is placed in the URL fragment (the part after #). Browsers never include the fragment in HTTP requests — it exists only in the user's browser and is never transmitted to or logged by the server.
What data is stored on the server?
Only the encrypted ciphertext and the expiry timestamp. No IP addresses, no usernames, no metadata that could identify the creator or recipient of a secret.
Do I need to create an account?
No. GloriaCrypt requires no sign-up, no email, and no account. Create a secret, share the link, done.
Is GloriaCrypt free?
Yes, it is completely free to use with no limits on the number of secrets you can create.
Can I use GloriaCrypt to share passwords securely?
Yes — sharing passwords is one of the most common use cases. Instead of sending a password over email or a messaging app (which can be stored, forwarded, or logged), you create a one-time link that self-destructs after the recipient reads it. You can also add password protection for an extra layer of security.
Can I share API keys or credentials securely?
Yes. GloriaCrypt is ideal for sharing API keys, SSH keys, database credentials, and other sensitive developer secrets. The one-time nature means the credentials cannot be accessed again if the link is later compromised.
What browsers are supported?
Any modern browser that supports the Web Crypto API — Chrome, Firefox, Safari, and Edge all work. The Web Crypto API has been standard since 2017.
No account needed. Free to use.