How it works
Your browser encrypts the text or file before it leaves your device. The server stores and returns only the encrypted blob.
The decryption key stays in the URL fragment after the #. Browsers do not send URL fragments in HTTP requests, so the server never receives that key.
What to trust
- The source code is public at github.com/donkeyx/dead-drop.
- Burn-after-read is atomic: one successful download consumes a drop.
- Client-side encryption is not a promise that the hosting server is harmless. Verify the code or run your own instance if you do not trust this one.
Do not use this service for anything where you cannot accept the risk of a compromised browser, server, or deployment.