Privacy
1 Encryption: The lockbox in your browser
Think of TamingShare like a high-tech lockbox. When you create a paste, your browser scrambles your text into total gibberish before it ever leaves your device.
We use AES-256-GCM, which is the same level of security banks use. By the time data hits our servers, it’s already unreadable. Since we never get the key to unlock it, even if someone hacked our database, all they would find is a pile of digital junk.
2 The # trick: What we do not see cannot hurt you
Your link looks like this: tamingshare.com/view/id=123#your-secret-key
The secret sauce is the # symbol. Browsers follow a hard rule: anything written after the # stays on your computer and is never sent to the website’s server. When your friend opens the link, their browser sees the key and unlocks the message locally. We are just the middleman holding a box we physically cannot open.
3 No paper trail
Normally, when you click a link, your browser whispers to the next site that you just came from TamingShare. That is a problem if your secret key is in the link.
We use a no-Referrer policy to shut that down. It tells your browser to keep its mouth shut. If there is a link inside your message and you click it, the next website has no idea where you came from. This keeps your key totally private.
4 Your IP address
To stop people from spamming the site, we check your IP address, but our database never stores the address itself. It stores a salted hash, a code that stands in for the address. We delete that code once a day has passed without a request from you.
Frequently Asked Questions
No. To us, your data looks like a3f9c2b1e7…, which is just random characters. Without the key that stays on your device, it is impossible to read. We could not peek even if we wanted to.
This is the self-destruct button. The second someone confirms they have read the message, it is deleted from our servers forever.
Note: it only deletes once they click Confirm. This prevents accidental deletions from link previews or bots checking the link.
There are two things to keep in mind:
- Trusting the Code: Since we send the scrambling code to your browser, you are trusting that our code is doing what we say. If you are a coder, you can view the source of this page to see the full encryption-in-the-browser code for yourself.
- Browser Extensions: Some browser extensions like coupon finders or sketchy ad-blockers can see what is on your screen or read your full URL. If you are sharing something super top-secret, it is best to use an Incognito or Private window where your extensions are turned off.
As long as you chose when you created it, from 5 minutes to 1 year. When the clock runs out the encrypted text is deleted whether or not anyone opened it.
Only up to a point. Your receipt tells you whether the secret is still on the server. Once it is gone, the receipt cannot tell you whether it was read, burned or expired, because the row holding it has been deleted.
Yes. Open the receipt you were given when you created the link and press “Burn this secret now”. If it went to the wrong person, that is how you take it back, as long as they have not opened it yet.
Up to 1 MiB from the website. An API key raises the limit to 5 MiB.
No. TamingShare takes text only: a password, an API key, a recovery code, a note. There is no upload box.
Yes, one POST with a bearer key. Your script does the encryption, so only the encrypted text and its IV reach us. Keys are issued by hand. See the API documentation.