Encrypted before upload
The secret is encrypted in the browser. What reaches the server is ciphertext stored in Postgres, not the message itself.
bQuick Secret
- Browser-side encryption
- Free to use
- MIT licensed
Free product of Binary Quest
Share a secret. Keep the key.
bQuick Secret is a privacy-first way to send a one-time secret. It is encrypted in the browser before upload, stored as ciphertext, and decrypted only in the recipient’s browser with a key the server never receives.
Browser-side encryption
Free to use
MIT licensed
Built so the server cannot read the secret
Plaintext never leaves the device. The link you share carries the key in a URL fragment the backend does not see.
Key stays in the link
Decryption uses a URL fragment key. The API never receives that fragment, the decrypt key, or the plaintext.
Keyless email notice
A notification email points at the secret without the key. You share the full secure link, including the fragment, on a separate channel.
Nothing sensitive is logged
Plaintext, passphrases, recipient emails after send, and full URLs with fragments are not stored or written to logs.
Free to use
bQuick Secret is a free product of Binary Quest Limited. Open it in the browser — there is nothing to install.
Open source
The web app, Go API, and database migrations are published under the MIT License.
How a secret is sent
01
Write it in the browser
Open secrets.bquick.io and enter the secret. Encryption happens on your device before anything is uploaded.
02
The server keeps ciphertext
The API stores the encrypted payload. It does not receive the fragment key needed to read it.
03
Share the full link yourself
Send the secure link, including #key, through a channel you trust. The email notice, when used, is keyless on purpose.
Open the app
bQuick Secret runs in the browser. The source is public if you want to read or self-host it.
Questions
Does the server store my secret?
It stores ciphertext. The decrypt key lives in the URL fragment, which the backend never receives.
Can I email the secret directly?
The notification email is keyless. You still need to share the full link, including the fragment key, yourself.
Is there a desktop download?
No. bQuick Secret is a browser app. Use the live site, or build it from the public repository.