Vuash is a simple web app that lets you share plain text through a single access link.
All encryption is done by the browser, no secret keys touch the server, and only the encrypted message is stored in the database.
- Browser encrypts the message and generates a secret key
- Browser discards unencrypted message
- Browser passes secret key along via URL fragment (not contained in the request)
- Server stores encrypted message in the database
- Browser shows message link by concatenating the encrypted message's unique URL with the secret key
- Server sends encrypted message
- Browser decrypts message with the secret key in the URL fragment
- If key is valid, show contents
- If key is invalid, show warning
- Server destroys the message
The app running at http://vua.sh is hosted on Heroku, with automatic deploys from this master branch. Production code is always paired with this repository.