Client-side authenticated encryption

The browser uses the Web Crypto API to encrypt each Relay with AES-256-GCM. GCM provides confidentiality and integrity: changing authenticated ciphertext, segment order, or protected metadata makes decryption fail. Large files are encrypted as ordered segments so the browser can process them without loading the entire file into memory.

Keys, Relay Codes, and passphrases

A standard link keeps key material after the # fragment. Browsers do not send that fragment in normal HTTP requests, so FiniteRelay receives the locator but not the standard-link decryption key. A Relay Code is an alternative locator, not a password. If you add a passphrase, the browser derives access locally; the passphrase is never submitted to our API.

Anyone who obtains the complete link—or the Relay Code plus any required passphrase—may be able to open the Relay. For high-risk material, share the passphrase through a separate channel and verify the recipient independently.

One-time means one successful server retrieval

The active payload record is deleted or claimed in the same database operation that authorizes retrieval. That prevents two normal recipients from successfully fetching the same active Relay. For large files, a short claim and signed-download flow lets the intended browser fetch the already consumed encrypted parts during a bounded retry window.

Metadata minimization, not metadata elimination

FiniteRelay still needs limited metadata: a pseudonymous locator, Relay type and size, creation and expiry times, claim state, account entitlements, and operational security records. Hosting, storage, payment, and network providers may also process IP addresses and technical logs. Client-side encryption protects content; it does not make service use invisible.

Threats outside the design

  • A compromised sender or recipient device can expose plaintext before encryption or after decryption.
  • A recipient can copy, photograph, or forward content after opening it.
  • Email security scanners or browser tools can follow links; use passphrase protection when that risk matters.
  • FiniteRelay cannot recover an expired, consumed, corrupted, or lost Relay.
  • No implementation or dependency can be guaranteed free of vulnerabilities.

Reporting a security issue

Send a concise report to auth@finiterelay.com. Include affected URLs, reproduction steps, and impact, but do not include live credentials, decryption keys, passphrases, payment-card data, or another person's Relay content. We ask researchers to avoid privacy violations, disruption, persistence, and accessing more data than necessary to demonstrate the issue.