PrivShare

Security You Can Understand

No black boxes. A transparent look at how PrivShare protects your data.

PrivShare combines browser-side authenticated encryption, zero-knowledge boundaries, and server-side deletion controls for text shares.

The Complete Journey

From creation to destruction, here is what happens at every step

1

Create & Configure

Choose your secure share options

Enter text or environment variables, or upload files, then customize access settings:

  • Expiration TimePreset, custom, or never-expiring windows
  • Owner ControlsRevoke or delete owned shares from the dashboard
  • Password ProtectionAdditional layer of security for sensitive content
  • Burn After ReadingDestroy immediately after first view
2

Client-Side Encryption

Your data is encrypted in your browser before upload

  • AES-GCM EncryptionAuthenticated encryption through the browser Web Crypto API
  • Zero-KnowledgeThe server stores only encrypted data and approved metadata
  • Random Key GenerationUnique cryptographic key for every share
  • Instant ProcessingBrowser-native cryptography with no plugins

Technical Detail: The implementation uses the Web Crypto API built into modern browsers for key generation and encryption.

3

Secure Storage & Link Generation

Encrypted data is stored with approved metadata only

The workflow uploads encrypted content with approved metadata such as expiration and burn settings. A unique share link contains two critical parts:

https://priv-share.com/s/share_id#encryption_key
  • Share IDIdentifies the encrypted content on our servers
  • Encryption Key (# fragment)Stays in the browser and URL fragment only

Why the # matters: URL fragments (everything after #) are not sent in HTTP requests. The implementation keeps the encryption key only in the link and the recipient's browser.

4

Recipient Access & Decryption

Content is decrypted entirely in the recipient's browser

  1. 1
    Password verificationIf enabled, password verification happens client-side
  2. 2
    Fetch encrypted contentEncrypted data is retrieved using the share ID
  3. 3
    Extract encryption keyKey is extracted from the URL fragment
  4. 4
    Decrypt in browserContent is decrypted locally using the Web Crypto API
  5. 5
    Display contentThe decrypted content is shown to the recipient

Privacy Goal: Plaintext content never touches PrivShare servers and decryption happens entirely in the recipient's browser.

5

Automatic Destruction

Server-enforced unavailability with no plaintext recovery

Content becomes unavailable when any of these conditions are met:

  • After ReadingDestroyed after the first authorized view if enabled
  • RevokedOwners can revoke a share immediately from the dashboard
  • Expiration TimeUnavailable once the expiration time passes
  • Manual DeletionOwners can delete owned shares immediately from the dashboard

No Recovery Possible: Retrieval is denied for expired, burned, and revoked shares, and lifecycle cleanup removes eligible encrypted records after approved grace windows.

Why This Matters

The zero-knowledge architecture provides these benefits

  • Reduced-Exposure Storage

    Only ciphertext and approved metadata are stored, so server compromise alone does not expose plaintext share contents.

  • Legal Protection

    The design keeps plaintext and decryption keys outside server custody.

  • No Lingering Data

    Expiration, burn-after-reading, and lifecycle cleanup reduce how long encrypted shares remain accessible.

  • Mathematical Privacy

    Server access alone cannot decrypt share content without the browser-held key.

Plaintext and keys stay out of server custody.

Ready to share securely?

Use zero-knowledge encryption and self-destructing links today.

Create Secure ShareRead FAQs