🔒 Military-Grade Security
SafeMonk uses advanced cryptographic techniques to ensure your secrets remain private. Here's exactly how we protect your data.
What This Means
- ✓Your secrets are encrypted before leaving your browser
- ✓Our servers only see encrypted gibberish
- ✓Encryption keys never touch our servers
- ✓Even we cannot decrypt your secrets
Traditional vs SafeMonk
Advanced Encryption Standards
AES-GCM 256-bit
The same encryption standard used by governments and banks worldwide.
- • 256-bit key length
- • Authenticated encryption
- • Tamper detection
- • NSA Suite B approved
PBKDF2 Key Derivation
Transform passphrases into cryptographically strong keys.
- • 210,000 iterations
- • SHA-256 hash function
- • Random salt per secret
- • Brute-force resistant
Web Crypto API
Browser-native cryptography for maximum security and performance.
- • Hardware acceleration
- • Secure key generation
- • Memory protection
- • Standards compliant
Atomic Operations
We use PostgreSQL's atomic transactions to ensure secrets are properly destroyed without race conditions, even under high load.
How It Works
- 1. User clicks "Reveal Secret"
- 2. Database decrements view counter
- 3. Returns encrypted data
- 4. Browser decrypts locally
- 5. Secret auto-deletes when views = 0
Multiple Destruction Triggers
Time-Based Expiry
Secrets automatically delete after your chosen time limit
View Limits
Set maximum number of views before destruction
True Deletion
Data is permanently removed from our systems
Anti-Link-Preview Protection
The Problem
When you share links on social media, messaging apps, or email, they often automatically fetch the content to show a preview. This could accidentally"burn" your secret before the intended recipient sees it.
Our Solution
- ✓Secrets require a user click to reveal
- ✓No automatic content fetching
- ✓Bots and crawlers can't burn secrets
⚠️ Protected Against
- • WhatsApp link previews
- • Slack unfurling
- • Discord embeds
- • Twitter/X cards
- • Facebook previews
- • Email client previews
- • Search engine crawlers
- • Security scanners
Hardened Security Headers
Content Security Policy (CSP)
Prevents XSS attacks and unauthorized script execution
Strict Transport Security (HSTS)
Forces HTTPS connections and prevents downgrade attacks
Referrer Policy
Prevents URL fragments (keys) from leaking via referrers
X-Frame-Options
Prevents clickjacking attacks via iframe embedding
X-Content-Type-Options
Prevents MIME type sniffing attacks
Row Level Security (RLS)
Database-level access controls and data isolation
How SafeMonk Compares to Alternatives
| Feature | SafeMonk | Pastebin | Cloud Storage | |
|---|---|---|---|---|
| Client-side encryption | ✅ | ❌ | ❌ | ⚠️ |
| Burn-after-read | ✅ | ❌ | ⚠️ | ❌ |
| Zero-knowledge | ✅ | ❌ | ❌ | ❌ |
| Anti-link-preview | ✅ | ❌ | ❌ | ❌ |
| File support | ✅ | ⚠️ | ❌ | ✅ |
| No registration required | ✅ | ❌ | ✅ | ❌ |
Transparent & Verifiable
All encryption operations happen in your browser where you can inspect them. Use your browser's developer tools to verify our security claims in real-time.