How it Works:

• Each client generates an ECDH keypair, consisting of a public key and a private key.
• Your private key is kept in localStorage, and never leaves your device.
• Your public key is embedded in the URLs you generate. This key can be safely shared anywhere without compromising security.
• When another client opens your generated URL, they will find your public ECDH key. They then generate a random IV for this specific message, and use it, along with their private ECDH key and your public ECDH key, to derive a shared secret (AES-GCM).
• This derived shared secret never leaves their device. It is used to encrypt their message to you. The encrypted message, along with their public key and the IV for this message, are embedded in the URL they generate.
• Upon opening the response URL, your device uses your private ECDH key, along with the public key and IV from the URL, to recreate the shared secret. This secret is used to decrypt the message. If the message was properly encrypted using the expected keys, it will be successfully decrypted and displayed to you.
• If you clear your browser's local storage, you will not be able to decrypt any response URLs generated with your previous unique URL.