Encrypted before it leaves the tab
Secret content is encrypted with AES-256-GCM in your browser. The decryption key lives in the URL fragment, which browsers never send to a server, so the backend stores an envelope it cannot open.
Features
A link that expires. And knows who it is for.
ravendrop is a way to hand someone a password without leaving it in a chat log forever. The encryption is the floor, not the feature — what follows is everything you can put around a single share.
01 / Protection
The content is encrypted before the server exists to it
Every guarantee on this page rests on one property: the key never reaches the backend.
A separate key for every recipient
HKDF derives a recipient-specific wrapping key that unwraps a separate content-root key. Revoking one recipient does not hand the others' access to anybody else.
Optional passphrase, hardened with Argon2id
Add a passphrase and the link alone is not enough. Argon2id runs in a browser worker, and the fragment key and passphrase jointly wrap the content key — so guessing stays expensive even for someone holding the full URL.
Tamper-evident envelopes
Authenticated encryption means a modified envelope fails to open instead of quietly returning altered plaintext.
02 / Control
Decide how long, how often, and who
A share is not just a link. It carries the rules it is willing to be opened under, and they are checked before a view is spent.
Expiry from five minutes to seven days
Pick the window that fits the job. Links created without an account are capped at one day; signing in unlocks the longer choices up to seven.
View limits that hold under concurrency
Allow between one and twelve views. View accounting is atomic, so simultaneous reveals and network retries cannot push a share past its limit. A rejected attempt consumes nothing.
Restrict to named recipients
Limit a share to specific mailboxes or to a whole domain. A restricted share requires the reader to sign in, and the check runs before a view is spent.
Country and IP allowlists
Add country, subdivision, or IPv4/IPv6 CIDR restrictions. Source information is accepted only from the trusted network boundary, and a restricted request is denied when that context is missing or unverifiable.
SAML single sign-on
Bring your own identity provider, so recipient restrictions resolve against the directory your organisation already maintains and access ends when an account is deprovisioned.
Destroy after reading
A recipient who has revealed a share with views still on it can destroy it so nobody else can open the link. Deleting re-runs the same region, IP, sign-in and passphrase gates, and consumes no view.
03 / Workflow
Made for the thing you were actually doing
Most secrets are shared in the middle of some other task. These exist so that task does not need a second tool.
Knows what you pasted — without telling anyone
As you type, the text is matched against the gitleaks reference rules in a browser worker and labelled, so a mistyped credential is caught early. The scan and its result never leave the page, so the operator learns nothing about what the envelope holds.
Generate the secret in place
Passwords, passphrases and templates can be generated in the browser rather than pasted in from somewhere they were already exposed.
Key pairs, generated locally
Generate ECDSA P-256 or RSA 2048/4096 key pairs in the browser and attach the PKCS#8 private key and SPKI public key as PEM files. With a passphrase the private key is written as encrypted PKCS#8.
File attachments
Attach up to ten files, four megabytes in total. Each file is encrypted and uploaded in chunks under an encrypted manifest, so filenames are no more visible to the server than the contents are.
Multiple recipients on one share
Address a small group — up to thirty-two — with per-recipient keys and per-recipient revocation, instead of sending the same link to everyone.
04 / Operate
Yours to host, or ours to run
The same code and the same security boundary, whether it runs on your own hardware or on ours.
Run it yourself
A hardened, non-root Docker image and Compose stack with an ordered one-shot migration, a persistent data volume and a readiness health check. The whole backend is one Rust binary over a SQLite/libSQL file.
Leaves little behind
Pages are served no-store with no referrer and a strict content policy that forbids inline script and third-party origins. There is nothing under the API worth indexing, and share links resolve entirely in the fragment.