How it works – Vanish by DBDriven

What happens when you create a note

Your browser generates a random 256-bit key.
It encrypts your note with that key using AES-256-GCM, entirely on your device.
Only the encrypted result is sent to us. We store it with the expiry you chose.
The key is put after the # in the link. Browsers never send that part of a link to a server, so the key never reaches us.

What happens when someone opens it

Opening the link just shows a page with a Reveal note button. Nothing is read or deleted yet, so email and chat apps that preview links cannot use up your note.
When the reader clicks Reveal, their browser proves it holds the key, and we hand over the encrypted note and delete it in the same step. Two people clicking at once cannot both get it.
Their browser decrypts the note locally and removes the key from the address bar.

Passwords

If you add a password, it is mixed into the key on your device (using PBKDF2 with 600,000 rounds). The reader then needs both the link and the password. A wrong password does not destroy the note, but after 5 wrong attempts it is deleted to stop guessing.

What we store, and for how long

The encrypted note, a random ID, and the time it expires. Nothing we could decrypt.
It is deleted the moment it is read, or when it expires: 1 hour to 1 week, your choice.
No accounts, no cookies, no analytics, no advertising.

What Vanish cannot protect against

Honesty matters more than marketing, so:

Whoever has the link can read the note. If someone intercepts it before your recipient opens it, they can read it, and your recipient will see that it is gone. That is your signal something went wrong. Adding a password sent another way closes this gap.
The reader's device. Once revealed, the note is on their screen. We cannot stop screenshots or copying.
Regulated data. Vanish is a general-purpose tool and is not certified for regulated information such as health records or controlled government data.

Who runs this?