Trust No One (Not Even Us)

At CipherSend, we believe you shouldn't have to trust the server to keep your secrets safe. That's why we offer client-side encryption. But what does that actually mean?

The Process

When you choose to encrypt a secret with a password on the client side, here is what happens before any data leaves your device:

1. Key Generation

Your password is not used directly as the encryption key. Instead, we use a Key Derivation Function (KDF) to turn your password into a cryptographically strong key. This makes it much harder for attackers to brute-force your password.

2. Encryption (AES-GCM)

We use the Web Crypto API, built directly into modern browsers, to encrypt your message using AES-GCM (Advanced Encryption Standard with Galois/Counter Mode). This provides both confidentiality (no one can read it) and integrity (no one can tamper with it).

3. Transmission

Only the encrypted blob is sent to our servers. The password you used to generate the key never leaves your browser.

Decryption

When the recipient opens the link:

1. They are prompted for the password.
2. Their browser derives the key from the password.
3. The browser downloads the encrypted blob from our server.
4. The decryption happens locally on their device.

Why This Matters

Because the server never sees the password or the raw secret, a compromise of our database would yield only useless, encrypted data. This architecture ensures that you are the true owner of your data.

Conclusion

Client-side encryption adds a powerful layer of defense. It ensures that privacy is mathematically enforced, not just promised by a privacy policy.