Frequently Asked Questions

What is a Snipto?

A Snipto is a small, private snippet of text that you can securely share with someone else. It’s like a tiny secret note that only the people with the full URL and encryption key can read. Once viewed, it vanishes automatically, so your message stays private and ephemeral.

How does encryption work?

All encryption and decryption happens locally in your browser. When you create a Snipto, your device encrypts the content before it ever leaves your computer or phone.

What gets stored on your servers?

We only store the encrypted form of your Snipto in our database. This means we never see the plain text. Without the encryption key, the stored data is meaningless to us.

Where is the encryption key?

Depending on the protection mode you choose, the encryption key is handled differently:

• Random URL Secret Key: The key is included in the URL after the # symbol. This part of the URL is never sent to our servers.
• Password Protected: The key is the password you provide. We only store a hash of your password for verification — the actual password never leaves your browser.
• Snipto ID (Asymmetric): The sender encrypts using the recipient's public Snipto ID. Only the recipient can decrypt by re-deriving their private key from their passphrase. The private key never leaves the browser.

In all cases, only someone with the correct key can decrypt the Snipto.

What happens to my Snipto after it’s viewed?

Sniptos are ephemeral by default. Once decrypted and viewed, they are automatically deleted permanently and cannot be retrieved again.

What happens if my snipto is never viewed?

If a snipto is never opened, it will be automatically deleted when it reaches its expiration time. By default, this happens one hour after creation. However, password-protected and Snipto ID snippets can be configured to last for up to one week. Sniptos are meant to be temporary, and shorter time-to-live settings help keep your data more secure.

What if the decryption key is lost?

If you lose the key (the # part of the URL or the password you chose), the Snipto cannot be decrypted. Since we never store or know your keys or passwords, we cannot help you recover them. No key, no decryption.

What kinds of content can I store?

Currently, Snipto only supports plain text snippets. In the future, we may expand support to other types of content while maintaining end-to-end encryption.

Is any personal information stored or collected with my Snipto?

No personal identifiable information is stored or collected with your Snipto. We only store the ciphertext (your Snipto in encrypted form), a unique random identifier used for decryption, and metadata about expiration and whether the Snipto has been viewed. Your IP address or any other identifying info is never stored with your Snipto.

How is a Snipto ID generated? Is it linked to my identity?

A Snipto ID is a 64-character pseudonymous identifier you create from a passphrase. When you click "Generate Snipto ID", your browser combines your passphrase with a fresh random value (a salt) to derive a cryptographic key pair. The ID you see is your public key plus that salt, encoded as text. The matching private key (needed to decrypt messages sent to your ID) is never stored anywhere; it is regenerated on demand from your passphrase.

No part of this process touches our servers. The ID, your passphrase, and the derived keys never leave your device. We have no record of which Snipto IDs exist, who created them, or when. Even when someone later uses your ID to send you an encrypted Snipto, what reaches our servers is only the encrypted payload and an ephemeral key; nothing about it identifies you, your IP address, or your device. A Snipto ID is not an account, not a profile, and not linked to your real-world identity in any way.

How can I be sure my Snipto is end-to-end encrypted?

All encryption and decryption happens directly in your browser. The JavaScript code that performs these operations (snipto.js) is fully readable for transparency.

You can also inspect any network requests in your browser while creating or reading Sniptos. You will see that only scrambled, unreadable ciphertext is ever sent to our servers — the plain text of your Snipto and your encryption key are never transmitted or exposed.

Snipto is an open-source project. All source code is available at https://github.com/tchubaba/snipto for anyone to inspect and verify. For those who want full control, you can also clone the repository and self-host your own instance of Snipto, ensuring your data never touches our servers.

How do you ensure my data hasn’t been tampered with?

Every Snipto uses a "digital seal" (technically known as an HMAC). This acts like a tamper-evident sticker on a package. When your browser decrypts the Snipto, it automatically checks this seal. If even a single character of the encrypted data was changed while stored on our servers, the seal will be broken, and Snipto will refuse to display the content to protect you.