How it works:

- AES-256-GCM encryption runs client-side in your browser

- The key lives in the URL fragment (#key) – browsers never send fragments to servers

- Server only stores encrypted blobs

The URL fragment trick isn't something I invented – it's just how HTTP works. The # and everything after it never leaves your browser. Check your network tab.

Built with SvelteKit, MongoDB, and the Web Crypto API.

Live: https://cloakbin.com

Source: https://github.com/ishannaik/cloakbin

Would appreciate feedback on the encryption approach or any security holes I might've missed.