B1 Drop

One link · one read · then gone

Send it once.
Then it’s gone.

Paste a password, a key or a note, or attach a file up to 5 MB. Your browser encrypts it before upload, and the key stays in the part of the link after #, which browsers don’t send to the server.

  • 01AES-256-GCM in your browser. We store ciphertext only.
  • 02The first reveal deletes it. A second open says “gone”.
  • 03Link previews in Slack or iMessage can’t open it. Revealing needs a click.
  • 04Expires after 1 hour, 1 day or 7 days, even if nobody opens it.
Or a file
Choose a file or drop it here · max 5 MB

If you add a file, it is sent instead of the message.

Expires after
Add a passphrase (optional)

Share the passphrase through a different channel from the link. We can’t recover it.

How a drop works

  1. Sealed here

    Your browser makes a random 256-bit key, encrypts the drop with it, and uploads only the ciphertext.

  2. Key in the fragment

    The key goes after the # in the link. Browsers don’t send that part to servers, so B1 Drop never sees it.

  3. Read once

    Clicking “Reveal” fetches the ciphertext and deletes it in a single database operation, then your browser decrypts it.

You don’t have to trust our word on this. Read the security model, including what B1 Drop does not protect against.