Sealed before it leaves
AES-256-GCM sealed, with an Argon2id key stretch that costs 46 MiB a guess. All inside the tab you are looking at.
Zero knowledge, no account, no tracking
Send a secret that only the right person can open
Paste a password, an API key or a whole env file. Credo seals it inside your browser with AES-256-GCM and hands you a link that expires on its own. The passphrase never leaves your device, so there is nothing on a server for anyone to read.
- AES-256
- GCM sealed
- 46 MiB
- Argon2id per guess
- 10 min
- shortest expiry
- 0
- accounts needed
In your browser
AES-256-GCM
What the database holds
The stored value is unreadable ciphertext, not the text you typed.How it works
Four steps, and the plaintext never moves
- 01
You write it
Type a note, paste a credential or attach a small file. Nothing has left the tab yet.
- 02
Your browser seals it
A key is stretched from your passphrase, then AES-256-GCM encrypts the payload locally with a fresh salt and nonce.
- 03
Only ciphertext travels
The sealed blob, a timestamp and an expiry are stored. The passphrase and the plaintext never leave your device.
- 04
They open it
The recipient loads the link, types the passphrase, and the decryption happens in their browser. Then the record expires.
What you get
Small tool, deliberate choices
Links with a lifespan
Every share carries an expiry, from ten minutes to thirty days. Thirty days is the ceiling, so nothing lingers by accident.
Notes or files
Env files, certificates, recovery codes, a paragraph of context. Whatever fits in a single sealed record.
A code to scan
Every link comes with a QR code, which is the easiest way to move a secret to a phone in the same room.
Your own quiet history
The links you make are listed in your browser only. There is no server side index of anyone's shares.
Nothing to sign up for
No account, no email, no analytics on what you share. Open the page and use it.
Full disclosure
Everything a Credo record contains
Five fields, and the database rules refuse anything else. There is no user id, no IP log, no recipient list and no copy of the passphrase, because none of it is written in the first place.
Read the security modelencrypted_dataThe sealed blob. Unreadable without the passphrase.created_atWhen the record was written.expires_atWhen it stops being served, and then gets deleted.fileA flag, present only when you attached a file.metadataThe original file name and type, so the download opens correctly.
Questions
The things people ask first
What is Credo?
Credo is a free web app for handing someone a password, an API key, a private note or a small file. Your browser encrypts the content before anything is uploaded, so the stored copy is ciphertext and nothing else. The person on the other end needs both the link and the passphrase to read it.
Does Credo cost anything?
No. There is no account to create, no paid tier and no usage limit beyond the size cap on a single share.
Can Credo read what I send?
No. Encryption and decryption both happen inside your browser using the Web Crypto API. The database holds a base64 blob it cannot interpret, a creation time, an expiry time and, when you attach a file, the original file name and MIME type so the download arrives intact.
What encryption does Credo use?
AES-256-GCM seals the payload, and Argon2id turns your passphrase into the key using 46 MiB of memory per attempt. Argon2id is the algorithm that won the Password Hashing Competition and it is memory hard, which is what stops an attacker from running millions of parallel guesses on a graphics card. Every share gets a fresh random 16 byte salt and a fresh 12 byte nonce, and the GCM authentication tag means a tampered payload fails to open rather than decrypting into something plausible.
Can Credo recover a lost passphrase?
No, and that is the whole point. The passphrase is never transmitted or stored, so there is nothing to look up. If it is lost, the ciphertext stays sealed forever and the only option is to create a new share.
How long does a Credo link stay alive?
You choose, from ten minutes up to thirty days. Thirty days is both the default and the ceiling, because nothing is retained beyond that. Once the moment passes the database refuses to serve the record and a scheduled cleanup deletes it.
Can I send a file with Credo?
Yes. Any file type is accepted up to roughly 700 KB per share, which is the practical ceiling for a single encrypted record. It is built for keys, certificates, config files and env files rather than for large media.
Where does my list of created links live?
In your own browser, in IndexedDB, with a localStorage fallback. The database rules block listing entirely, so nobody can enumerate shares, including the people running Credo. Clearing your browser data clears the list while the links themselves keep working until they expire.
More of them on the questions page.
Stop pasting passwords into chat
It takes about twenty seconds, and the copy you send stops existing on a schedule you choose.