Hidden is a place to leave a message, or a handful of files, at an address that stops working once its views are spent or its time runs out. You write something, you get a link, you hand the link to whoever is meant to read it. When the last allowed view is spent, the note is deleted: the row is removed, not flagged.
Without a password, anyone with the link can read the note — pass it on carefully.
What the browser does before anything is sent
Your text and your attachments are packed into a single binary block and encrypted in the tab you are typing in, with AES-GCM 256. The key is derived from the address of the link itself using PBKDF2-SHA-256 — 2,000 iterations when there is no password, 250,000 when there is. The key is never sent anywhere.
The address is invented by the browser, not handed down by the server; the server only claims it, answering 409 if that address is already taken. The order is the point: the encryption is finished before the first request leaves your machine.
The alphabet of the address
Addresses use Crockford base32: 0123456789ABCDEFGHJKMNPQRSTVWXYZ. No I, no L, no O, no U — the four characters people mistype when they read a link out loud or copy it by hand. Case does not matter; the address is accepted however you type it.
What the server actually holds
- the ciphertext
- the IV
- the conditions — views remaining, expiry time
- a verifier: a short SHA-256 fingerprint of the key
- the creation time, the size of the ciphertext and whether there is a password
The uncomfortable part
Since the key is derived from the address, and the server necessarily knows the address, the server can technically decrypt a note that has no password. We would rather say it here than let you find it out later.
So the protection is somewhere else. A note without a password is protected by its short life: it lives a day at most, and if its views are limited, it is destroyed the moment the last one is spent. If you need the note to be a secret from the server as well, give it a password — the password goes into the key, and the address alone is no longer enough.
Password
The password is checked against the verifier before the encrypted data is requested. A wrong password costs nothing: it does not use up a view. Having a password also makes guessing far costlier: 250,000 iterations instead of 2,000.
Views and lifetime
Views: 1, 2, 3, 5, 10, or no limit. Lifetime: 15 minutes, 1 hour, 3, 6, 12, or 24 hours. Whichever runs out first ends the note.
Opening takes two steps. The link leads to a screen that asks whether you want to open the note; only when you press the button does the browser send POST /api/notes/:id/open. That way a link preview generated by a messenger cannot burn a view on your behalf.
This is the last view. The moment you open it, the note is deleted and the link stops working.
That request increments the counter atomically. If the view was the last one, the row is removed in the same moment — not queued for cleanup. Notes that simply expired are swept once a minute.
Files
You can attach files to a note; they are encrypted in the same block as the text, and there is no separate upload. On the receiving side, Download all produces a zip containing the message as note.txt alongside the attachments, and Photos and videos takes only the media. The archive is assembled in the browser, from data that was already decrypted there.
The limits, plainly
- 256 MB per note
- at most 24 hours
- 40 attempts per 10 minutes from one IP address
The interface is available in English and Russian, in a light and a dark theme. If that is all you needed to know, the rest is at hidden.sc.