envsafe.io

Secrets get shared insecurely every day. An API key dropped into Slack, a .env block pasted into a DM, database credentials emailed to a new hire. Once a secret lands in a chat history or an inbox it lives there forever, readable by anyone with access to that account and every integration bolted onto it. Most "secure" sharing tools still see your plaintext on their servers, which means you're trusting their infrastructure, their staff and their breach response with the exact thing you were trying to protect. The honest threat model is simple: if the server can read your secret, so can an attacker who reaches the server.

EnvSafe encrypts in the browser before anything leaves your machine. You drop in a secret, set how long it should live and how many times it can be opened. The browser generates a fresh 256-bit key, encrypts with AES-GCM and sends only the ciphertext to the server. The decryption key never touches the wire. It lives in the URL fragment, the part after the # that browsers keep client-side and never include in a request. You share one link. The recipient opens it, the key rides in the fragment, the browser pulls the ciphertext and decrypts locally. After the last view the secret burns: the server deletes the ciphertext and the link goes dead. The server's entire knowledge of your secret is a blob it cannot read.