Encryption Technology

How AES-256-GCM via the Web Crypto API powers zero-knowledge one-time secret sharing: IV rules, fragment keys, ciphertext-only servers, and honest browser limits.

Why zero-knowledge secret tools put the decryption key after # in the URL. RFC 9110 fragment behavior, bearer-URL limits, and referrer/analytics caveats.

Self-hosting OneTimeSecret moves trust to your server — it does not make server-side encryption zero-knowledge. Client-side vs self-host cutover with honest limits.

Zero-knowledge encryption means the provider stores ciphertext it cannot decrypt. How it differs from E2EE and zero-knowledge proofs, plus URL-fragment secret sharing.

OneTimeSecret documents server-side encryption; VanishingVault uses client-side AES-256-GCM with a URL-fragment key. DevTools check, phishing clones, self-host ≠ ZK.

ZK vs E2EE vs encryption-at-rest: who holds the keys, what providers can read, subpoena nuance, and how URL-fragment secret sharing fits.

Cloudflare Secrets Store holds Worker config secrets — different job from a ZK one-time link tool. AES-256-GCM in the browser, URL-fragment keys, Workers + KV burn-after-read, and threat model.

Why client-side encryption and URL-fragment keys are the default for one-time secret sharing — plus honest limits (browser trust, bearer URLs).