How It Works
The technical details behind dead-drop.xyz
Cryptographic Architecture
Your password is converted into a 256-bit encryption key using PBKDF2 with 100,000 iterations and SHA-256. A random 16-byte salt ensures unique keys even for identical passwords.
Content is encrypted using AES in Galois/Counter Mode with a 256-bit key. GCM provides both confidentiality and integrity—any tampering is detected.
Drop IDs are derived from names via SHA-256. Admin passwords for public drops are hashed with salt. This one-way function ensures identifiers cannot be reversed.
Creating a Drop
Choose a Name
Enter a unique drop name (12+ characters for free drops). Spaces auto-convert to hyphens.
- Input is normalized: lowercase, spaces → hyphens, invalid chars removed
- Name is validated against reserved words (api, admin, etc.)
- Minimum length ensures security against brute-force enumeration
Set Visibility
Choose Private (encrypted) or Public (plaintext readable by anyone).
- Private: Password encrypts content client-side, zero-knowledge
- Public: Content visible to all, password only for edit/delete
Enter Password
Your password secures the drop. For private drops, it derives the encryption key.
- Password never leaves your browser
- Combined with random salt for key derivation
- Choose a strong, memorable password
Add Content
Enter your text content (up to 10KB for free drops).
- Content is wrapped in a typed payload structure
- Supports text/plain MIME type
- Future: file uploads
Encrypt & Upload
For private drops: content encrypted locally. Then uploaded to edge storage.
- AES-256-GCM encryption with PBKDF2-derived key
- Drop ID = SHA-256(normalized_name)
- Stored on Cloudflare D1 with 7-day expiration
Accessing a Drop
Navigate to Drop
Visit dead-drop.xyz/#your-drop-name or enter the name in the View panel.
- Fragment (#) ensures name never hits server logs
- Client normalizes name and computes ID locally
Fetch Metadata
Client requests drop metadata by ID (SHA-256 hash, not name).
- Server returns: visibility, salt, IV, encryption algorithm, expiry
- No content returned until authenticated/decrypted
Unlock
For private drops, enter password to decrypt. Public drops show content immediately.
- Password derives same encryption key locally
- Key decrypts ciphertext in your browser
- Server never sees password or plaintext
View & Manage
Read, edit, or delete the drop. All operations require password verification.
- Edit: re-encrypts with same key, new IV
- Delete: removed from active database; residual copies may persist in backups or snapshots
- Content hash used for optimistic concurrency
Privacy by Design
Fragment Routing
URL fragments (the # part) are processed client-side only. Your drop name never appears in server logs, CDN caches, or ISP records. We see requests for /, not /#your-secret.
Client-Side Crypto
All encryption happens in your browser using the Web Crypto API. Your password and plaintext never traverse the network. We receive only encrypted bytes.
No Accounts
No registration means no email addresses, no passwords to leak, no user profiles. Drops exist independently of any identity system.
Auto-Expiring Drops
Standard drops automatically expire after 7 days. Deletion removes data from our active database but is not cryptographic erasure — residual copies may persist in backups, storage snapshots, or other infrastructure.
Open Source
Don't trust—verify. The entire codebase is available on GitHub. Audit the cryptography, review the API implementation, or self-host your own instance. If you like what you see, we'd appreciate a star!
⭐ Star on GitHub