Dead Drop: a note that is read once — even in a browser
Sometimes the person you need to reach isn’t a contact. They don’t have YGOOW, you won’t meet them, and the thing you need to tell them — a door code, a new number, an address — shouldn’t sit in a chat history for the next five years.
That is what a Dead Drop is for: a one-time note behind a link. You write it, you get a link, you send the link however you like. Whoever opens it reads the note once, and the relay deletes it. It works in the app, and from today it also works in any browser at ygoow.com/d.
The first thing that burns a one-time link is a robot
Paste a link into almost any chat app and, before the recipient sees anything, a server fetches it to draw a preview. A note that self-destructs “on first open” gets opened by that preview bot, and the person it was meant for finds nothing.
So a Dead Drop link keeps everything that matters after the #:
https://ygoow.com/d#<id>.<key>
Browsers never send the part after # to any server — not ours, not the preview bot’s. The bot fetches a page that knows nothing. And neither the app nor the page contacts our relay until a human presses Open.
The relay can’t read it, and can’t be fooled into deleting it
The note is sealed on your device — or in your browser — with AES-256-GCM under a key derived from the random key in the link, and padded to one of four size classes, so the stored size says little about how long the text is. The relay stores the sealed block and a salted hash of a verifier. To collect the note, a client has to present a proof derived from the key; only then does the relay hand it over and delete it, in one transaction.
A wrong proof, an expired note and a note someone already opened all get the same answer. There is nothing to probe. Twenty wrong proofs destroy the note, because a password guessed online over Tor has no per-address limit to slow it down.
A password on a separate channel
You can add a password. It is stretched with Argon2id (64 MiB of memory per guess) and folded into both the encryption key and the proof — so whoever has only the link can neither read the note nor burn it. Send the link in one app and the password in another, or say it out loud.
What a browser can’t promise
We built the browser page because a recipient without the app is the whole point. But a web page is a weaker place for cryptography than an installed app, in two ways, and the page says both on its face:
- The code comes from our server every time. In the app, the code that decrypts was installed once. On a web page, it is delivered each time the page loads — so if our server were compromised, the page could be changed. The page has a strict Content Security Policy, loads nothing from anyone else, and its one third-party component is pinned to a known hash in our test suite; that narrows the risk, it doesn’t remove it. If a server you don’t control is in your threat model, open the link in the app.
- Over a normal connection, our server sees your IP address. We don’t log it, but “we don’t” is a promise. Open the link in Tor Browser — our onion address serves the same page.
And the one thing no one can promise: “gone after reading” means our relay deletes the note. You can’t verify that from outside, which is exactly why the note is encrypted anyway — and a recipient can always take a screenshot.
It works where JavaScript is on a short leash
Tor Browser at its “Safer” level switches WebAssembly off. The page’s hashing and key derivation are plain JavaScript and its encryption is the browser’s own Web Crypto, so notes without a password still open there. Only a password needs WebAssembly (for Argon2id); in that case the page tells you what to switch, and sends nothing.
Check the math in your own browser
The app and the web page are two independent implementations of the same construction, pinned to the same test vectors — computed from the specification by a third, reference implementation. The page runs those vectors for anyone who asks: the Dead Drop self-test re-derives every key, including Argon2id at full memory, and re-seals every test note byte for byte, right there in your tab.
Leave one: ygoow.com/d.