Einmalpost.de

Own project: a service for confidential notes that delivers a secret exactly once and then forgets it. The sender types a text and receives a link; whoever opens it sees the content a single time — after that it is irretrievably deleted. Encryption happens entirely in the browser, the key never reaches the server. No accounts, no cookies, no IP logs. Plain PHP 8.3 without a framework, backed by more than 470 automated tests across three real browsers.

Starting point

Passwords, credentials and private messages travel by email or messenger every day — and stay there permanently, in inboxes, backups and chat histories nobody pays attention to later. One-time message services exist, but almost all of them demand trust: you have to believe the operator is not reading along. The real task is a different one: building the service so that even the operator cannot read anything — and then proving that promise instead of merely stating it.

What we built

Einmalpost encrypts every message with AES-256-GCM directly in the browser, using the WebCrypto API. The key lives exclusively in the URL fragment behind the #, which browsers never transmit to servers — the server only ever stores unreadable bytes. Anyone who captures the database and the entire server finds nothing decipherable. On retrieval the entry is deleted atomically: even with simultaneous requests, exactly one wins, verified with real concurrent processes. The service deliberately stores no IP addresses, and the server's access logs are switched off entirely. Technically the site is plain PHP 8.3 without a framework, backed by MariaDB. The project is bound to twenty written commitments — from encryption to deletion behaviour — and every single one was deliberately broken in code during a dedicated audit session, to prove that the test suite notices the break. Static analysis at PHPStan's highest level, 120 unit tests, 75 integration tests against a real database and 276 browser tests in Chromium, Firefox and WebKit run before every release, alongside live checks against production and a scan of the entire git history for accidentally committed credentials.

Result

einmalpost.de is live and works without an account, a cookie banner or advertising. All twenty commitments are proven by the adversarial audit session rather than merely promised, and the 470+ tests run on every change. The project shows how we build security-critical applications: zero-knowledge architecture as a foundational decision, not a marketing word.