Browser-side AES-256 credential sharing. The key stays in the URL fragment.
by AArdian
DELETO is a small secret-link tool. The browser encrypts the payload with AES-256-GCM before it leaves the tab. The key is kept in the URL fragment, so it is not sent to the server on request. You set an expiry or a view limit; after the last read the ciphertext is gone. No signup for the basic path. The site says they do not log IPs and cannot read plaintext.
Repo dele-to/dele-to is Next.js 14 + React 18 + Tailwind, Redis via @upstash/redis, MIT, package.json author arddluma. 103 stars on this check. A paid "Deleto Cloud" page offers a dedicated instance on your domain.
This is a known pattern (fragment-key burn links). It is listed because the live app, the source, and the crypto claim are all public and the URL resolved. Do not describe the encryption as anything stronger than AES-256-GCM in the browser; "military-grade" is the site's word, not ours.
Built with
Last checked 2026-09-01 11:44 UTC
Open live app ↗| timestamp | result | latency |
|---|---|---|
| 2026-09-01 11:44 UTC | live | 117ms |
| 2026-08-26 21:21 UTC | live | 156ms |
| 2026-08-26 20:12 UTC | live | 253ms |