How the wall works

Rome wrote on its walls. Whitewashed boards by the forum carried the day's notices, and the plaster of Pompeii still holds greetings, jokes, debts and love notes scratched there by people who never gave a name. Anyone passing could read them; nobody could say who had written them.

This is that wall, kept honest by mathematics. You leave a message locked behind a phrase; whoever speaks that exact phrase reads it. Nothing here asks who you are — no account, no email, no name, no link to share, no inbox. The phrase is the address and the key at once, and it is the only thread between the one who writes and the one who reads.

The name nods at another door: the room that appears only for someone who already knows what they need, and can say it. Pace the corridor with the right words in mind and it opens; pass by without them and there is nothing there but wall. Ours works the same way, only the magic is arithmetic — speak the phrase and the note is waiting; speak anything else and the stone stays blank.

In plain words

  • Your phrase never leaves this browser. It is turned into a key on your own machine, before anything is sent anywhere.
  • The note is locked before it travels. The wall receives scrambled text and has no way to unscramble it — not the operator, not the database, not anyone reading the wire.
  • The wall stores a fingerprint of the phrase, not the phrase. It is enough to find your note and not enough to turn back into words.
  • A wrong phrase looks exactly like an empty wall. Nothing tells a guesser they were close, or that a note is there at all.
  • Notes fade on their own after 1 to 30 days, and anyone who can unseal one can burn it on the spot.
  • A note holds up to 4,000 characters. It is a scrawl on a wall, not a filing cabinet.
  • Lose the phrase and the note is lost. There is no reset, no recovery, no one to ask.
The cryptography, in detail

The phrase is trimmed, normalised (NFKC) and stretched with Argon2id (RFC 9106) at 64 MiB of memory, 3 iterations, parallelism 1, over the fixed application salt wall-of-requirements:v2. The memory cost is the point: a GPU that would run thousands of cheap guesses in parallel fits only a couple of hundred at 64 MiB each, and is throttled by memory bandwidth rather than core count.

One derivation produces 64 bytes, split into two independent halves. Bytes 0–32 become the index hash, the deterministic lookup key the server stores in hex. Bytes 32–64 become the AES-GCM-256 key, which never leaves the browser. Knowing the stored half tells you nothing about the other; both cost the same single Argon2id call, so splitting one output halves your wait without cheapening an attack.

The message is sealed with AES-GCM-256 under a fresh 12-byte random nonce per note. GCM authenticates as well as encrypts: ciphertext altered in storage or in transit fails to open rather than decrypting to something else.

The server is only ever sent four values: index_hash, ciphertext, nonce and ttl_days. Reading is the mirror image — the index hash goes out, ciphertext comes back, and it is opened here. Failure to decrypt and no note found are collapsed into the same answer, and every reveal takes a fixed minimum of three seconds so the response time itself reveals nothing.

Knowing the phrase is the only authority that exists. The server holds no identity and cannot tell an author from a reader, so whoever can unseal a note can also burn it. Burning frees the phrase for someone else to claim. Requests are rate limited per IP — ten reveals, five notes and ten burns per minute.

What is guaranteed — and what is not

Guaranteed

  • The phrase and the plaintext are never transmitted, logged or reported — not to the server, not to an error tracker.
  • A full dump of the database yields ciphertext, nonces, index hashes and timestamps. There is no key anywhere in it, and none on the server.
  • A wrong phrase is indistinguishable from a phrase nobody has used, in both the answer and the timing.
  • Expiry is enforced on read as well as on write, so a note past its time is never returned even if a sweep has not run yet.

Not guaranteed

  • A weak phrase is the whole weakness. Anyone holding the stored index hashes can guess phrases offline. Argon2id makes each guess expensive; it cannot make “password” or a line everyone knows safe. Use the suggested phrase, or something no dictionary contains.
  • The salt is fixed for the whole wall. One Argon2id computation per candidate phrase tests every note at once. A per-note salt is impossible here: the phrase alone has to locate the note, with nothing else to go on.
  • You are trusting the code you were served. The encryption happens in JavaScript delivered by this site, so a compromised server could ship a version that keeps your phrase. Zero-knowledge describes what is stored, not blind faith in delivery — read the source, or the network tab, if it matters to you.
  • Metadata is visible. When a note was pinned, when it expires and roughly how long it is can all be seen by whoever runs the storage.
  • Anonymity is not invisibility. No name is asked for or kept, but requests still arrive over the network: your address reaches the host, and a short-lived per-IP counter throttles floods. If you need to be unreachable as well as unnamed, come through Tor or a VPN.
  • A taken phrase announces itself. Pinning onto an occupied phrase is refused, which confirms that some note lives behind it.
  • The phrase grants everything, forever. There is no revocation and no second factor: anyone who learns it later can read the note and burn it.
Return to the wall