Tockermail

Tockermail sends a password, key or private note as a one-time link instead of through chat, email or text, where such things sit in searchable history and get forwarded. A message is written and encrypted in the sender's own browser before anything uploads: the browser makes a random 256-bit key, stretches it with 600,000 rounds of PBKDF2, and encrypts locally, with the key living only in the link's fragment, which browsers never send to a server. The recipient opens the link, reads the message once, and it is deleted; if a link was already opened, the page says so and advises rotating the credentials.

At rest, the server wraps the already-encrypted blob in a second layer of AES-256-GCM under a separate server key. Opening is a deliberate transactional action, a status-conditional database update picks exactly one winner among simultaneous opens and deletes the stored blob in the same request, so link-preview bots cannot accidentally burn a message. Signed-in users get a dashboard to label and withdraw unopened messages, longer expiry windows, encrypted reply threads, and team-gated links that require a signed-in member before they open.

Zero-knowledge holds fully for the share-the-link-yourself path. The optional convenience of letting Tockermail email the link for you passes the link's key through the server once in memory, never stored, a trade-off the product states openly and recommends offsetting with an added passphrase. Paid plans are modelled but not yet chargeable.