crypt.fyi - A zero-knowledge, end-to-end encrypted secret sharing platform that enables secure and private transmission of sensitive data.

• 🔐 End-to-end encryption using ML-KEM post-quantum cryptography
• 🛡️ Strict Content Security Policy (CSP) to prevent XSS attacks and unauthorized resource loading
• 🛡️ Strict rate limits to mitigate brute-force attacks
• 🤫 Zero-knowledge architecture - server never sees unencrypted data or decryption keys
• 🔥 Burn after reading w/ provisions to prevent erroneous burns from bots or url introspection
• 🔥 Burn after n read failures
• ⏰ Automatic expiration (Time-To-Live)
• 🗝️ Password protection
• 📁 File sharing support w/ drag and drop
• 🪝 Webhook notifications for read success, read failure, and burn events
• 🌐 IP/CIDR allow-listing
• 🔢 Read count limits
• 📱 QR code generation
• ⌨️ CLI for interacting with the API
• 🧩 Chrome Extension
• 🐳 Docker images for the api server and web client
• 🌐 Internationalization support for multiple languages
  • Currently supported: View supported languages
  • Contributions welcome for new translations!

1. Encryption key is generated on the client
2. Password is optionally provided
3. Encryption key and password are used to encrypt the secret
4. Encryption key and password are hashed and stored along with the encrypted secret for verification on retrieval - the raw key and password are never stored or transmitted on/to the server
5. The unique URL containing the decryption key is generated on the client
6. Share the URL with your recipient and separately the password if specified
7. When accessed, only when the decryption key and password match via server-side verification of the hashes, the encrypted secret is shared and decrypted in the recipient's browser
8. Optionally, the secret is automatically destroyed after being read in an atomic read & delete operation guaranteeing only one person can access the secret
9. If retrieval doesn't happen within the TTL, the secret is automatically destroyed

RFC

OpenAPI Specification

API_URL=https://{your-domain-here} docker compose up --build

1. Clone the repository
2. Enable Corepack (uses the packageManager field → pnpm):

   corepack enable

3. Install dependencies:

   pnpm install

4. Set up environment variables (see .env.example)
5. Start the development server:

   pnpm dev

Publishable packages: @crypt.fyi/core and @crypt.fyi/cli (npm), plus the Chrome extension.

1. Record changes: pnpm changeset
2. Merge to main — the Release workflow opens a Version Packages PR (or publishes when that PR is merged)
3. Required GitHub secrets for publishing:
   • NPM_TOKEN
   • CHROME_EXTENSION_ID, CHROME_CLIENT_ID, CHROME_CLIENT_SECRET, CHROME_REFRESH_TOKEN, CHROME_PUBLISHER_ID

• Noble cryptography
• React
• shadcn/ui
• Node.js
• Fastify
• Redis
• OpenTelemetry

• Production CSP (including style-src hashes for sonner/Radix inline styles) lives in nginx/nginx.conf
• vite preview applies that same policy via packages/web/csp.ts so local/CI match production
• pnpm test:e2e runs Playwright against vite preview under that CSP (default create→read→burn, password unlock). It fails on style-src / connect-src violations; other console warnings/errors and non-style CSP noise (e.g. script-src eval fallback notes) are reported as non-blocking annotations
• The e2e API uses an in-memory rate limiter and dedicated ports (:4322 API / :4173 preview by default) so local pnpm dev and shared Redis rate-limit keys cannot poison the suite. Playwright rebuilds the web client with that API URL before preview so CSP connect-src matches the baked client config.
• When a test fails on style-src, add the reported hash to nginx/nginx.conf (do not weaken to 'unsafe-inline')
• Reference: sonner#449

• Ensure Redis is running locally when developing the server
• The web client expects the API to be available at http://localhost:4321 by default
• CSP headers in development may differ from production configuration

• Always test encryption/decryption flows thoroughly when making changes
• Ensure no sensitive data is logged or exposed in error messages
• Maintain strict CSP headers to prevent XSS vulnerabilities
• Keep dependencies updated for security patches

Contributions are welcome! Please feel free to submit an Issue or Pull Request on GitHub.