VanishKeyA KPT Industries product

One link. One look.Then nothing.

Share passwords, API keys, and private notes with a one-time encrypted link. After one reveal, it's gone.

A carnivorous plant feeding a paper credential into a glowing VanishKey shredder
AES-256-GCM · HKDF · one-time access

What would you like to share?

Expires after 1 hour
Need a fresh credential?Generated only on this device with cryptographic randomness.
Character sets

● encrypted in your browser before upload

AES-256-GCM + HKDF One-time access Automatic deletion
Private by designSee how the disappearing act works
01

Create

Your browser encrypts the secret before upload. The decryption key stays in the complete link—not in VanishKey storage.

02

Share

Send the link however you prefer. Its reveal capability stays after the #, beyond ordinary link previews.

03

Gone

Opening the complete link retrieves and permanently deletes the encrypted copy, then decrypts it on the recipient's device. Unopened links expire after one hour.

Protocol v3

Under the hood.

Boring cryptography done carefully—not a hand-wavy "military-grade" label.

AES-256-GCM + HKDF Domain-separated AEAD
A fresh 256-bit master secret is never used raw. HKDF-SHA-256 derives the AES-256-GCM key bound to the secret id. A 96-bit IV and authenticated additional data make tampering fail closed instead of yielding corrupted plaintext.
PBKDF2 600k Optional passphrase
Add a passphrase and recipients need both the link and that phrase. Password material is stretched with PBKDF2-HMAC-SHA-256 (600,000 iterations), mixed into the key schedule, and checked via a key commitment before the one-time ciphertext is burned.
256 + 256 Split capabilities
Lookup id, framing byte, master secret, and reveal token are independent CSPRNG values. Every fragment byte is randomized; the fragment stays after # so ordinary HTTP requests and link previews never send it.
ATOMIC Single-use retrieval
The live store holds only ciphertext, IV, and non-secret KDF metadata under a SHA-256(reveal) key, with a one-hour TTL. Reveal is an atomic get-and-delete; the browser decrypts locally.

Security boundary: anyone holding the complete URL (and passphrase, if set) can reveal the secret. Direct email intentionally passes that URL through VanishKey and Mailgun. Keys never live in the ciphertext store.

Automation-friendly

Secrets for carbon and silicon.

Give people, AI agents, and automated workflows the same private way to share credentials without placing them in chat or logs. Our lightweight client encrypts locally and returns a single-use link.

Read agent.txt

Local encryption • no readable secret storage • one-time access

The same privacy model

Automation should not weaken encryption.

  • Encrypt locallyUnencrypted secrets are never stored.
  • Share onceEach complete link allows one automatic reveal.
  • Delete automaticallyEncrypted data disappears after access or expiry.