En

Enclosed on Ubuntu 24.04 LTS

Azure Security

Enclosed, a self hosted app for sending private end to end encrypted notes and secrets that only the sender and the recipient can ever read.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

Enclosed is an open source, minimalist tool for sharing secrets. You write a note or attach a file, and everything is encrypted right there in your browser with AES 256 before anything leaves the page, so the server that stores it only ever holds unreadable ciphertext and never sees your content or the key. Enclosed hands you a single link to pass to the person you are sharing with; the key that unlocks the note lives in the link itself, in the part after the hash that browsers keep local and never send to a server. The recipient opens the link and reads the note in their own browser, with no account and nothing to install. Before you send, you can lock a note behind an extra password, limit it to a single view so it destroys itself once read, and set it to expire after an hour, a day, a week or a month, which makes it a clean way to hand someone a password, an API token or a private message without leaving it sitting in chat or email.

Why the cloudimg image

Enclosed ships locked down: it is bound to the loopback interface and reached only through a reverse proxy, and creating notes requires a login so a public instance cannot be turned into an open relay by passers by, while the people you share links with still need no account to read them. The sign in secret and the token signing key are generated fresh on every instance at first boot and written to a file only root can read, so nothing usable is baked into the image and no two instances share a secret. The stored notes are opaque ciphertext and the image ships carrying none of them. Every deployment is fully patched at build time with unattended security updates left enabled, and comes with a paired deploy guide and 24/7 cloudimg support.

Common uses

  • Send a password, API key or private message as a one time, self destructing link
  • Give teams a self hosted, zero knowledge way to share secrets without third party services
  • Hand a contractor or client a credential that expires automatically after a set time

See it running

Real screenshots taken while testing this image against its deployment guide.

Enclosed on Ubuntu 24.04 LTS screenshot 1 Enclosed on Ubuntu 24.04 LTS screenshot 2 Enclosed on Ubuntu 24.04 LTS screenshot 3 Enclosed on Ubuntu 24.04 LTS screenshot 4