Boring cryptography, explicit boundaries.
VanishKey is a capability-link delivery service—not a vault, identity provider, or managed secrets platform. This page documents what the design protects, what the service receives, and where the protection ends.
Protocol v3 at a glance
| Content encryption | AES-256-GCM with a fresh 96-bit IV |
|---|---|
| Key derivation | HKDF-SHA-256 bound to the secret identifier |
| Optional passphrase | PBKDF2-HMAC-SHA-256, 600,000 iterations, random 128-bit salt |
| Lookup identifier | Independent 256-bit CSPRNG value |
| Reveal capability | Independent 256-bit CSPRNG value, stored only as a one-way verifier |
| Maximum lifetime | 3,600 seconds |
| Maximum plaintext | 1,000 UTF-8 bytes |
Key schedule and authenticated binding
The sender creates a 256-bit master secret and never uses it raw as an AES key. HKDF derives the encryption key and binds it to the random secret identifier. AES-GCM authenticated additional data binds the ciphertext to its identifier and KDF mode, causing tampering or transplantation to fail closed.
Passphrase-protected links mix separately stretched password material into the key schedule. A key commitment lets the browser reject an incorrect passphrase before consuming the one-time encrypted envelope.
What the service receives
Normal browser and agent creation sends ciphertext, an initialization vector, non-secret derivation metadata, a key commitment, and a one-way verifier for retrieval. Plaintext, the master secret, the derived AES key, the passphrase, and the complete capability fragment are not sent on that path.
The live encrypted envelope exists only in short-lived in-memory storage. A successful reveal performs a single atomic retrieve-and-delete operation before local decryption. Unopened envelopes expire after one hour.
Operational defenses
- Secret and API responses are marked
no-store. - Reveal pages are excluded from search indexing and crawler access.
- A per-request nonce-based Content Security Policy excludes unsafe inline script.
- Creation, reveal, email, and support endpoints enforce size and rate limits.
- Direct-email tracking, open tracking, and click tracking are disabled.
- Aggregate usage counters contain no secret or recipient identifiers.
Explicit limitations
- Anyone holding the complete URL—and passphrase, if set—can reveal the secret.
- Compromised endpoints, browsers, extensions, clipboards, or delivery accounts can leak plaintext.
- A recipient can copy or capture plaintext after a legitimate reveal.
- Direct email is lower assurance because the complete link passes through VanishKey and its mail provider.
- Deletion and expiry cannot retract a secret already disclosed elsewhere.
Independent review status
VanishKey has not yet received an independent cryptographic or penetration-test audit. No system can promise absolute security. The protocol description, agent client, disclosure channel, and limitations are public so reviewers can evaluate concrete claims rather than marketing language.
Report vulnerabilities to support@kptindustries.com. Please do not include live secrets in a report.
Share the secret—not a permanent copy.
No account. One reveal. One-hour maximum lifetime.