F.A.Q.

A drop is an ephemeral container for text content. You create it with a unique name (like "my-secret-project"), optionally protect it with a password, and share the URL. Drops automatically expire and are removed from our database after 7 days.

Private drops use zero-knowledge encryption: your content is encrypted client-side with your password, and we never see the plaintext. A password is required to both read and edit. Public drops store content as plaintext—anyone with the URL can read it, but a password is still required to edit or delete.

No. dead-drop.xyz requires no registration, no email, no personal information. Just pick a name, optionally set a password, and create your drop. This is by design—no accounts means no data to leak or compromise.

Zero-knowledge means the server never has access to your unencrypted content. When you create a private drop, your password never leaves your browser. The encryption happens entirely client-side using the Web Crypto API. We literally cannot read your data, even if compelled to.

Standard drops automatically expire after 7 days. Deletion removes the data from our active database, but is not necessarily immediate and may occur later. Residual copies may persist in database backups, storage snapshots, or other infrastructure.

Private drops use AES-256-GCM encryption with keys derived via PBKDF2 (100,000 iterations). This is the same class of encryption used by governments and financial institutions. However, security also depends on your password strength—use a strong, unique password.

Yes. For private drops, you need the content password to delete. For public drops, you need the admin password you set during creation. Deletion removes the drop from our active database, though residual copies may exist in backups or storage snapshots (see below).

For private drops: the content is irrecoverable. We genuinely cannot help you—this is the trade-off of zero-knowledge encryption. For public drops: you can still read the content, but you will need the admin password to edit or delete.

Yes. The entire codebase is available on GitHub. You can audit the cryptography or contribute improvements. You are welcome to self-host, though we have not yet optimized the setup process for seamless deployment.

Standard drops are limited to 10KB of text content. This is sufficient for code snippets, configuration files, credentials, and short messages.

URL fragments (the part after #) are never sent to the server. This means your drop name never appears in server logs or ISP records. When you share dead-drop.xyz/#my-secret, our servers only see a request for "/" — complete privacy.

Yes. A full REST API is available for machine access. You can create, read, update, and delete drops from scripts, CI/CD pipelines, and other automation tools. See the API Documentation for details.

dead-drop.xyz is hosted entirely on Cloudflare infrastructure—Pages for the frontend, Workers for the API, and D1 (SQLite) for storage. This provides global edge performance and enterprise-grade reliability.

When a drop is deleted or expires, we remove it from our active database. However, this is not cryptographic erasure — the data is not securely overwritten on disk. Residual copies may exist in database backups, storage-level snapshots, or other Cloudflare infrastructure. This applies to both public and private drops — encrypted data that persists could theoretically be decrypted in the future if cryptographic weaknesses are discovered.

We store only what is necessary: the drop ID (a SHA-256 hash of your drop name, not the name itself), encrypted content or plaintext (depending on visibility), cryptographic parameters (salt, IV), expiration date, and metadata like creation time and version. We do not collect personal information, emails, or account data. Note that third parties—your ISP, Cloudflare—may independently collect data like your IP address. We have designed dead-drop to minimize the data intermediaries could potentially access.

No. dead-drop is intended for legitimate privacy-preserving communication—sharing credentials, code snippets, configuration files, and similar content. If presented with valid legal orders (such as a court order or law enforcement request), we will comply to the extent required by law.