Zero-knowledge design
At SendSecure, privacy is the primary design goal. We never have access to your plaintext messages, password, or the decrypted contents of an attached file. Encryption and decryption occur in your browser.
What we store
The server stores only the minimum data required to deliver the service:
- Encrypted messages (ciphertext only).
- Encrypted file blobs, if you attach a file (maximum 25 MB).
- Random salts and initialization vectors needed for client-side decryption.
- Basic metadata such as creation and expiry time.
Your password is never transmitted to us. Without it, stored content remains cryptographically unreadable.
How data is protected
- Encryption and decryption happen in your browser with WebCrypto and browser-side Argon2id.
- Messages and files use AES-GCM with 256-bit keys.
- Argon2id provides memory-hard key derivation designed to resist specialized cracking hardware.
- Every encrypted item receives a unique random salt and IV.
- Successfully decrypted content is permanently deleted from the server.
- Unopened content automatically expires after your selected 1–7 day period.
Cookies, tracking, and disclosure
SendSecure does not use advertising cookies, analytics trackers, or third-party marketing scripts. We do not track you across sites, build user profiles, or sell behavioral data.
We do not sell, rent, or share encrypted content with third parties, and there are no integrations with advertisers, social networks, or analytics providers.
SendSecure follows best practices for secure transport and handling. Even after a server compromise, stored payloads are designed to remain unreadable without the user's password.
Your consent
By using SendSecure, you agree to this Privacy Policy. Changes will appear on this page with an updated effective date.