How Gone keeps a secret.

What is Gone?

Go + One = Gone

Gone is a tool for sharing secrets privately, readable only one time. The server component is written in Go, a language designed for simplicity and efficiency by Google. The client-side application is built with vanilla JavaScript and modern WebCrypto APIs to perform encryption and decryption directly in your browser.

Gone is open source software. The source code is available on GitHub under the GNU Affero GPL v3.

What encryption does Gone use?

Gone uses AES-256-GCM provided by WebCrypto APIs for client-side encryption, which is the same encryption trusted by banks, governments, and security-conscious organizations worldwide.

How Gone keeps secrets secret

Gone is designed so the server never learns your secret. The critical cryptography happens entirely in your browser before anything is sent over the network.

High-level flow

1. You type a message and/or attach files in the form. Before anything leaves your device, the browser generates a fresh, random encryption key.
2. Client-side encryption (using modern WebCrypto primitives) packs the message and files together and transforms them into a single opaque blob. File names and types are encrypted too.
3. Only the encrypted blob is sent to the Gone server. The key never leaves the browser.
4. The server stores just that blob plus minimal metadata (expiry time and one-time state).
5. A shareable URL is produced. The secret key is embedded in the URL fragment (the part after #), which browsers never send to the server.
6. The recipient opens the URL and presses Open; their browser extracts the key locally and downloads the encrypted blob. From that moment the secret is reserved for them alone; anyone else who opens the link sees that it is gone.
7. Decryption happens client-side; the browser verifies every byte arrived intact before showing anything. The server remains blind to the plaintext the entire time.
8. Confirmed deletion: once the recipient’s browser has the complete secret, it tells the server to delete it. If that confirmation never arrives (closed tab, dropped connection), the server deletes it automatically a few minutes later. Either way, it can never be read twice.

File attachments

• Attach up to 10 files of any type. The message and all files share one size limit, shown on the form.
• Files are encrypted in your browser exactly like the message; the server cannot see their names, types, or contents.
• The recipient downloads each file individually or all at once. Gone warns them before leaving the page with files still unsaved, because the secret cannot be opened again.
• File names are cleaned up (folders and hidden control characters removed), and uncommon file types are saved as generic downloads so they can’t run in the browser.

Optional passphrase

• The sender can add a passphrase. Opening the secret then takes both the link and the passphrase, so a leaked link alone is not enough.
• Send the passphrase separately from the link, for example the link by email and the passphrase by phone. Gone never stores the passphrase and cannot recover it.
• Your browser stretches the passphrase with PBKDF2 (600,000 rounds) and mixes it with the link’s key. Every wrong guess costs real time, but a short or common passphrase can still be guessed by someone who has the link. Use Generate for five random words.
• As you type, Gone shows the passphrase’s estimated entropy in bits and roughly how long it would take to guess. The estimate assumes someone who already has the link and can make a million guesses a second against the stretched passphrase. It’s a guide, not a guarantee: names, dates, and well-known phrases fall faster than it shows.
• If the passphrase is wrong, the recipient can try again as many times as they need without downloading the secret again.
• Opening the link uses up the secret even if the passphrase is wrong. A passphrase keeps a leaked secret unreadable, but cannot stop someone with the link from destroying it.
• Generated passphrases use the EFF short wordlist by the Electronic Frontier Foundation, licensed under CC BY 3.0 US.

Checking or deleting a secret you sent

• On the result page, open Manage this secret for a private manage link. Keep it for yourself, and don’t send it with the one-time link.
• The manage link shows whether the secret is still waiting, and lets you delete it before anyone opens it.
• It can never open the secret. Once the secret is opened, deleted or expired, the server keeps no record of it, so the manage page can only say it’s gone.
• Deleting works even while someone is opening the secret, but it can’t take back anything their browser has already downloaded.

QR codes

• Handing a link over in person? On the result page, press QR next to Copy link and let the recipient scan the code with their phone. The code only appears when you ask for it.
• Request links never get a QR code. A code hides the address it opens, which makes it easy to swap for a fake one, so send request links as text, where the address can be checked.

Requesting a secret

• Need a secret from someone? Request a secret makes a link for you to send them. They type the secret on that page, and it comes back to you.
• Your browser makes a key pair. The private key is stored in this browser in a form no web page can read out, so the reply can only be opened here, even after you close and reopen the browser. The public key travels in the link’s fragment, which never reaches the server.
• Their browser encrypts the reply to your public key (ECDH P-256, then AES-256-GCM). The server stores only ciphertext and can’t read it, and each request takes one reply.
• Your label for a request stays in this browser. The server only learns how long to wait.
• Anyone with the request link can send the one reply, so send it only to the right person. If you’re answering a request, check it came from who you expect.
• Clearing this site’s data, or using a private window, loses your requests. Make a new one if that happens.

Languages

• Gone is available in English, Spanish, French, German and Brazilian Portuguese. It starts in your browser’s preferred language.
• The globe button in the header switches the language in place, without reloading, so a link you just made or a secret you just opened stays on the page.
• Your choice is kept in a cookie that holds only the language.
• Translations other than English are made by machine. Corrections are welcome on GitHub.

Why this matters

• Zero server knowledge: Compromise of the storage tier yields only ciphertext.
• Ephemeral access: One-time retrieval shrinks the attack window.
• Short TTLs: Automatic expiry further limits exposure if a link lingers.
• No password reuse risk: You never transmit existing credentials in the clear.

Threat model notes

• Always verify you are on HTTPS (the app warns if not).
• The secrecy guarantee assumes the sender’s and recipient’s browsers are not compromised.
• Anyone who obtains the full share URL (including its key component) can decrypt the secret until first read or expiry, unless the sender added a passphrase.
• If someone else opens the link first, the intended recipient will see that the secret is gone, a clear sign the link was intercepted.
• Attachments are only as safe as the device they are saved to; delete downloaded files when you no longer need them.

What does the GNU Affero GPL v3 mean for you?

Gone is free, open source software under the GNU Affero General Public License version 3 (AGPLv3). Here is what that means in plain English. This is a summary, not legal advice; the license itself is what counts.

If you use Gone to send or open secrets

• You have no obligations. Using Gone puts no license terms on you or on what you share.
• If someone runs a modified version of Gone, they must let you download its source code.

If you host or change Gone

• You may run Gone unmodified for any purpose. Leave its copyright and license notices in place.
• You may change Gone however you like. If other people use your changed version over a network, you must offer them its complete source code, free of charge and under the AGPLv3. A link in the footer is enough.
• If you change Gone, give your version its own name and logo. The Gone name and logo are trademarks and aren’t covered by the AGPLv3; see the trademark policy.
• You don’t have to send your changes back to this project, though contributions are welcome.
• Changes you keep to yourself, with nobody else using them, carry no obligation to share.
• If you give someone a copy of Gone, such as a container image, include the license and the source code or tell them where to get it.

If you are a company

• You may use Gone commercially, including running it as a paid service for customers.
• The same rules apply as for anyone else. Unmodified, there is nothing to share. Modified, anyone who uses your version over a network must be offered its source code under the AGPLv3.
• You can’t relicense Gone or your changes under closed terms, and you can’t remove its copyright or license notices.

To read the full license, visit the GNU website.