What we store
- The encrypted message (ciphertext), padded so it only hints at the length.
- When it expires and how many times it may be opened.
- Fingerprints (SHA-256 hashes) of tokens that prove a reader has the full link, the password and, for the sender, the manage link.
- Daily totals for the live stats page: how many messages were created, opened and expired. Nothing about individual messages.
What we never see
- The message itself, or the key to unlock it.
- Your password. It never leaves your device.
- Who you sent it to. We don’t ask, and message pages load nothing from other companies.
The details, for the curious
The key. For every message your browser makes a fresh 256-bit key with the operating system’s random generator. It goes into the link after the #, the URL fragment. Browsers keep the fragment to themselves: it isn’t sent to the server, it isn’t in our logs, and it isn’t passed on as a referrer.
Encryption. From that key we derive an AES-256-GCM key with HKDF-SHA-256. GCM also detects tampering, so a changed message fails to open instead of showing something wrong. All of it uses WebCrypto, the encryption built into every modern browser. There is no extra crypto library to trust.
Passwords. If you add a password, your browser stretches it with PBKDF2 (600,000 rounds of SHA-256) and mixes it with the link key. Both are needed to decrypt. To limit guessing, the reader’s browser also sends a token derived from the link key and the password. We store only a hash of that token, so we can count wrong tries without learning the password. After 4 wrong tries the message destroys itself.
Read once, for real. Each message lives in its own Cloudflare Durable Object, a tiny storage unit that handles one request at a time. Opening, counting and deleting happen in one step, so two people opening the link at the same moment can never both get it. A reader also has to prove they hold the full link before anything happens, so someone who only knows the message ID can’t burn your message.
Safe from link previews. Chat apps and mail scanners open links to build previews. A temp.cool link first shows a “Show the secret” button and loads nothing secret until a person taps it.
Expiry. Every message sets an alarm for its expiry time. When it fires, the message and everything about it is wiped. No cron job, no cleanup script.
Where it lives. Messages are stored only in Cloudflare’s EU jurisdiction, so they stay in data centres inside the European Union.
What temp.cool can’t protect against
Being honest about limits is part of security.
- Anyone with the full link can open it. Treat the link like the secret itself. For extra safety add a password and share it another way, like in a call.
- A compromised device. If the sender’s or recipient’s device has malware, it can read the message on screen, like anything else you type or read.
- What the reader does next. Once opened, the recipient can copy or screenshot it.
- Trust in the page itself. As with every web app, you trust that the page we serve does what it says. Our encryption code is small and we plan to publish it, so anyone can check it.
Found a security problem? See our security.txt.