Enclosed, a self hosted app for sending private end to end encrypted notes and secrets that only the sender and the recipient can ever read.
Enclosed is an open source, minimalist tool for sharing secrets. You write a note or attach a file, and everything is encrypted right there in your browser with AES 256 before anything leaves the page, so the server that stores it only ever holds unreadable ciphertext and never sees your content or the key. Enclosed hands you a single link to pass to the person you are sharing with; the key that unlocks the note lives in the link itself, in the part after the hash that browsers keep local and never send to a server. The recipient opens the link and reads the note in their own browser, with no account and nothing to install. Before you send, you can lock a note behind an extra password, limit it to a single view so it destroys itself once read, and set it to expire after an hour, a day, a week or a month, which makes it a clean way to hand someone a password, an API token or a private message without leaving it sitting in chat or email.
Enclosed ships locked down: it is bound to the loopback interface and reached only through a reverse proxy, and creating notes requires a login so a public instance cannot be turned into an open relay by passers by, while the people you share links with still need no account to read them. The sign in secret and the token signing key are generated fresh on every instance at first boot and written to a file only root can read, so nothing usable is baked into the image and no two instances share a secret. The stored notes are opaque ciphertext and the image ships carrying none of them. Every deployment is fully patched at build time with unattended security updates left enabled, and comes with a paired deploy guide and 24/7 cloudimg support.
Real screenshots taken while testing this image against its deployment guide.