Home / Account / Your vault / Send to my vault

Your vault · send from any browser

Send to my vault

A browser with no passkey can still keep what it holds: it encrypts it to your vault's key and appends it to your vault's inbox, which it can write to and never read.

What this page does

Your vault opens with your passkey, and some browsers cannot reach it: one an app opens a link in, one signed in to nothing, an old iPad. What they hold, your reads, your notes and the stories you saw on the wire, would stay there. This page sends it to your vault without the passkey.

• The link comes from your vault, in the pane’s Vault tab, as a URL, as text or as a QR code. It carries two things: where to write, an append lane on your reader vault, and the public key to encrypt to. Nothing else: not your vault’s key, not its read key.
• What is sent is this browser’s own records, as one file, encrypted here to that key (RSA-OAEP and AES-256-GCM, sgit’s hybrid envelope) and appended to the lane. The vault server sees ciphertext, a size and a time.
• This browser can add and cannot read. The lane answers a write with {"ok": true} and nothing more; not even what was sent can be read back from here.
• Your vault takes it in the next time you open it with your passkey: the Vault tab lists what is waiting, from which browser and when, and brings it in on one press, with this browser as its author.
• Nothing is removed from this browser. The count of what is only here goes to zero once it is sent; the records stay.

Anyone holding the link can add to the lane, and nobody holding it can read anything. Your vault shows what arrived before it brings it in, and can make a new link, which stops the old one. The brief is Sixteen notes I did not want to lose; the design is in the note.