Glossary

Terms and definitions

Core Concepts

Drop: An ephemeral container for text content. Each drop has a unique name, optional password protection, and an expiration date. Drops are identified by their name, not by user accounts.
Drop Name: A URL-safe identifier for a drop (e.g., "my-secret-project"). Names are normalized to lowercase with hyphens replacing spaces. Standard drops require 12+ characters.
Drop Password: The secret string used to encrypt (private) or authenticate (public) a drop. For private drops, this password derives the encryption key. Choose strong, memorable passwords.
Fragment Routing: Using URL fragments (#name) instead of paths (/drop/name) for drop access. Fragments are never sent to the server, ensuring the drop name never appears in logs or DNS records.

Standard Drop: Free tier drop: max 10KB, text only, 7-day lifespan, requires 12+ character name. Perfect for sharing code snippets, credentials, or short messages.
Private Drop: Content is encrypted client-side. Password required to read, edit, or delete. Server sees only encrypted data. Maximum privacy.
Public Drop: Content is stored as plaintext. Anyone with the URL can read it. Password required only to edit or delete. Good for non-sensitive shared information.

Zero-Knowledge: A security model where the server has no knowledge of the plaintext content. For private drops, encryption happens client-side; the server only stores ciphertext and cannot decrypt it.
Client-Side Encryption: Encryption that occurs in your browser before data is sent to the server. Your password never leaves your device. The server receives only encrypted data it cannot read.
Ephemeral: Designed to be temporary. Standard drops have a 7-day lifespan. Deletion removes data from the active database but is not cryptographic erasure — residual copies may persist in backups, storage snapshots, or other infrastructure. This applies to both public and private drops.

AES-256-GCM: Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode. The encryption algorithm used for private drops. Provides both confidentiality and integrity verification.
PBKDF2: Password-Based Key Derivation Function 2. Used to convert your password into an encryption key. We use 100,000 iterations with SHA-256 to make brute-force attacks impractical.
SHA-256: Secure Hash Algorithm with 256-bit output. Used for generating drop IDs from names and hashing admin passwords. One-way function: cannot be reversed.
Salt: Random data added to a password before hashing or key derivation. Prevents rainbow table attacks and ensures identical passwords produce different encrypted outputs.
IV (Initialization Vector): A random value used alongside the key for AES encryption. Ensures that encrypting the same content twice produces different ciphertext. 12 bytes for AES-GCM.