Your message,
delivered if you can't.

How it works

A sealed envelope.
The envelope is math.

Five small steps. The first three are yours. The last two only happen if you go quiet.

1. 1. You write what matters.

   Passwords, account numbers, where the keys are — or just "I love you, here's what to do." Anything your people would need if you weren't around. Nothing is uploaded in plaintext.

   Where the random key lives (AES‑GCM)

   Your browser quietly generates a fresh, random 256‑bit key — a number with 78 digits in front of it. It uses that key to scramble your message with AES‑GCM. The plaintext never leaves the page; only the scrambled blob is uploaded.

2. 2. You name who gets it.

   A spouse, a kid, a lawyer, a best friend. Each one gets a private copy of the key, locked with something only they control.

   One vault key, different lock per person

   For every recipient, the vault key is wrapped using a secret only they hold: a shared passphrase, an RSA public key, or a PGP key. Even if every wrapped copy leaked tomorrow, no one except those exact people could unwrap them.

3. 3. You check in, on your schedule.

   Once a week, once a month — your call. One tap resets the clock. Keep tapping and nothing ever happens.

   What each ping writes on the server

   You pick a window — say, 30 days. Each ping stamps your account with the current time. A small scheduled job checks every day whether your last ping is still inside the window. If it is, it sits quietly and does nothing.

4. 4. If you go quiet, we nudge you first.

   Miss the window and the message doesn't fire — you get a 7-day warning, one quiet reminder email a day. On vacation? Phone dead? One click cancels everything.

   Grace mode: active → grace_period

   When the threshold elapses, the system flips your account from active to grace_period and anchors a 7-day countdown. A scheduled job emails you each day with the days remaining and a one-click "I'm here" link. Any ping during this window resets the timer back to zero and clears the warning state. You can change the warning window length (1–14 days) in your settings.

5. 5. Only then are your people notified.

   If the warning window also passes in silence, each recipient gets a link. They fetch the sealed vault and unwrap it on their own device — passphrase, RSA key, or PGP secret stays with them; we never run decryption for them or see the plaintext letter. What they read is assembled in their browser, same as you wrote it.

   Their keys, their tab — two opaque downloads

   The recipient downloads two things: the scrambled vault, and their personal wrapped copy of the vault key. In their browser they unwrap and decrypt locally — the service only stores and serves ciphertext and wraps; it does not hold their unwrap secret and cannot turn that into plaintext for them.

Why you can trust this