How it works
The useful details, without the security theatre.
Before sending
Your browser generates a random encryption key and encrypts the secret on your device. Only the encrypted result is uploaded. The key is placed after the # in the link, a part browsers do not send to our server.
When revealed
Opening the page does nothing. Only pressing “Reveal and destroy” claims the encrypted payload. It is removed atomically before being returned, then your browser decrypts it with the key from the link.
Passphrases
A passphrase adds a second encryption layer. Send it through a different channel. Without one, possession of the complete link is possession of the secret.
What we can see
We can see who created a link, its label, expiry, size, and read state. We cannot see its encryption key, passphrase, or plaintext. Labels are not encrypted, so never put the secret in one.
Links made by agents
Claude and the mdpockla CLI can mint links through md pockla instead of pasting a credential into a transcript. That path encrypts on md pockla’s server with the same envelope, so the plaintext exists in its memory for one request and is never stored or logged. It is a real difference from the browser path, where nothing but you ever sees the value.
The honest limit
This is zero-knowledge against our database, logs, and storage—not against a compromised deployment of our own frontend. Like every browser-crypto tool, the code that decrypts the secret is served by us. A compromised recipient device or clipboard is also outside this protection.