How it works:
- AES-256-GCM encryption runs client-side in your browser
- The key lives in the URL fragment (#key) – browsers never send fragments to servers
- Server only stores encrypted blobs
The URL fragment trick isn't something I invented – it's just how HTTP works. The # and everything after it never leaves your browser. Check your network tab.
Built with SvelteKit, MongoDB, and the Web Crypto API.
Live: https://cloakbin.com
Source: https://github.com/ishannaik/cloakbin
Would appreciate feedback on the encryption approach or any security holes I might've missed.