Frequently Asked Questions

What is a Snipto?

A Snipto is a small, private snippet of text that you can securely share with someone else. It’s like a tiny secret note that only the people with the full URL and encryption key can read. Once viewed, it vanishes automatically, so your message stays private and ephemeral.

How does encryption work?

All encryption and decryption happens locally in your browser. When you create a Snipto, your device encrypts the content before it ever leaves your computer or phone.

What gets stored on your servers?

We only store the encrypted form of your Snipto in our database. This means we never see the plain text. Without the encryption key, the stored data is meaningless to us.

Where is the encryption key?

Depending on the protection mode you choose, the encryption key is handled differently:

• Random URL Secret Key: The key is included in the URL after the # symbol. This part of the URL is never sent to our servers.
• Password Protected: The key is derived from the password you provide. We only store a verification token computed in your browser from your password — the actual password never leaves your browser.
• Snipto ID (Asymmetric): The sender encrypts using the recipient's public Snipto ID. Only the recipient can decrypt by re-deriving their private key from their passphrase. The private key never leaves the browser.

In all cases, only someone with the correct key can decrypt the Snipto.

What happens to my Snipto after it’s viewed?

Sniptos are ephemeral by default. Once decrypted and viewed, they are automatically deleted permanently and cannot be retrieved again.

What happens if my snipto is never viewed?

If a snipto is never opened, it will be automatically deleted when it reaches its expiration time. By default, this happens one hour after creation. However, password-protected and Snipto ID snippets can be configured to last for up to one week. Sniptos are meant to be temporary, and shorter time-to-live settings help keep your data more secure.

What if the decryption key is lost?

If you lose the key (the # part of the URL, the password you chose, or the passphrase behind your Snipto ID), the Snipto cannot be decrypted. Since we never store or know your keys, passwords or passphrases, we cannot help you recover them. No key, no decryption.

What kinds of content can I store?

Currently, Snipto only supports plain text snippets. In the future, we may expand support to other types of content while maintaining end-to-end encryption.

Is any personal information stored or collected with my Snipto?

No personal identifiable information is stored or collected with your Snipto. We only store the ciphertext (your Snipto in encrypted form), a unique random identifier used for decryption, and metadata about expiration and whether the Snipto has been viewed. Your IP address or any other identifying info is never stored with your Snipto.

How is a Snipto ID generated? Is it linked to my identity?

A Snipto ID is a 64-character pseudonymous identifier you create from a passphrase. When you click "Generate Snipto ID", your browser combines your passphrase with a fresh random value (a salt) to derive a cryptographic key pair. The ID you see is your public key plus that salt, encoded as text. The matching private key (needed to decrypt messages sent to your ID) is never stored anywhere; it is regenerated on demand from your passphrase.

No part of this process touches our servers. The ID, your passphrase, and the derived keys never leave your device. We have no record of which Snipto IDs exist, who created them, or when. Even when someone later uses your ID to send you an encrypted Snipto, what reaches our servers is only the encrypted payload and an ephemeral key; nothing about it identifies you, your IP address, or your device. A Snipto ID is not an account, not a profile, and not linked to your real-world identity in any way.

How can I be sure my Snipto is end-to-end encrypted?

Your text is encrypted by your own browser before it is sent. What reaches our servers, and what sits in our database, is a block of unreadable characters. We have nothing to read, nothing to sell, and nothing to hand over.

If you lose your key, we cannot recover your Snipto for you. That is not a policy choice; it is what end-to-end encryption means in practice: we never have the ability to read your Snipto, so there is nothing we could recover. The same property that makes a lost key final is what keeps your content private from everyone, including us.

The code that encrypts inside your browser (snipto.js) is delivered to you in clear, readable form, and the entire project is open source at https://github.com/tchubaba/snipto for anyone to inspect and verify. Independent security researchers can read exactly what your browser does before your data ever leaves your device.

The one exception is the opt-in E2EE-disabled mode, which sends text as-is. That is why the app warns you whenever it is on.

For the technically curious

Open your browser's developer tools (F12), go to the Network tab, and create a Snipto: you will see that only ciphertext is sent to our servers. Want full control? Our official Docker Hub image, purpose-built for self-hosters, is available at https://hub.docker.com/r/tchubaba/snipto ready to pull and run: your own instance, your own infrastructure, and your data never touches our servers.

How do you ensure my data hasn’t been tampered with?

Every Snipto uses a "digital seal" (technically known as an HMAC). This acts like a tamper-evident sticker on a package. When your browser decrypts the Snipto, it automatically checks this seal. If even a single character of the encrypted data was changed while stored on our servers, the seal will be broken, and Snipto will refuse to display the content to protect you.