Zero-knowledge encryption
How GloriaCrypt keeps your secrets safe
Every secret is encrypted in your browser before it touches the network. The server stores only unreadable ciphertext — and deletes it the moment the link is opened.
- 01
You write your secret
Type your password, API key, private note, or any sensitive data into the form. Nothing is sent anywhere at this point — it stays in your browser.
- 02
A key is generated in your browser
Your browser generates a random 256-bit encryption key using the Web Crypto API. This key never leaves your device and is never sent to the server.
- 03
Your secret is encrypted locally
The secret is encrypted with AES-256-GCM — the same standard used by banks and governments — producing unreadable ciphertext. Only the ciphertext is sent to the server.
- 04
A one-time link is created
The server returns a unique ID for the stored ciphertext. GloriaCrypt builds a share link with the decryption key in the URL fragment — the part after # that browsers never send to servers.
- 05
The recipient opens the link
When your recipient visits the link, their browser reads the key from the URL fragment and decrypts the ciphertext locally. The plaintext is only ever visible in their browser — never on the server.
- 06
The secret is permanently deleted
As soon as the secret is decrypted, it is immediately and permanently deleted from the server. The link is dead. Even GloriaCrypt cannot recover it.
Why the URL fragment matters: Browsers never include the #fragment in HTTP requests. This means the decryption key is never transmitted to the server — not even in server logs. It only exists in the recipient's browser.
No account needed. Free to use.