Kryptex is a capability-based, end-to-end encrypted service for sending or requesting short-lived secrets without an account. Encryption and decryption run in the browser. The service stores encrypted envelopes and protocol state, not readable secret content or decryption keys.
- A React client creates keys, encrypts content, derives capabilities, and removes secret URL fragments from the address bar before rendering a secret page.
- A Cloudflare Worker validates requests and serves the client. Plaintext, passphrases, second keys, link seeds, and content keys must never reach it.
- SQLite Durable Objects serialize retrieval, write-once, expiry, shorten, and revoke state.
- A private R2 bucket stores ciphertext. Durable Object alarms perform primary cleanup; a 31-day lifecycle rule is an orphan backstop.
- Cloudflare Turnstile runs only in an isolated creation gate. It is an abuse control, not part of encryption or capability authorization.
Compromise of the served browser code can expose secrets used after that compromise. A recipient can also retain plaintext after retrieval; expiry cannot take it back. See the threat model for the full boundary.
- Send: create an encrypted secret, share the
/s#…recipient link, optionally send a second key through an independently secured channel, and retain or discard the/m#…management link. - Request: define fixed fields, share the write-only, write-once
/r#…link, optionally send a second key separately, and retain the/i#…pickup link. - Consume: retrieval and pickup require an explicit consuming action. Loading a page or making a
GETrequest does not consume a release or write capability.
The detailed state and retry rules are in product flows. The wire format is frozen in protocol version 1.
Install Bun 1.3.14, then follow development and local-operation setup. The short path is:
bun install --frozen-lockfile
bun run devLocal development also needs the environment files described in that guide. Never deploy from a workstation. Every push and pull request runs the verification gates in .github/workflows/ci.yml; production ships from a version tag through .github/workflows/deploy.yml.