Whispery
Self-destructing secrets
Visit live site (opens in a new tab)- Year
- 2026
- Sector
- Security · privacy product
- Services
- Identity, Web, Mobile app, Engineering
- Platforms
- Web · App
- Stack
- TypeScript · React · Expo · @noble/ciphers · Redis · Turborepo
XChaCha20-Poly1305, atomic burn-after-read, and a signature ember-burst reveal. Web and mobile from one audited crypto core.
The brief
Sharing a secret over chat or email leaves it lying around forever. We wanted a way to hand someone a password once, prove the server never sees it, and have it vanish the instant it's read.
Our approach
A dark 'vault' aesthetic: Space Grotesk on near-black, glassy cards, a sealed redaction bar before the reveal. The decryption happens in the browser; the key lives only in the URL fragment, which is never sent over the wire.
The build
Audited XChaCha20-Poly1305, atomic burn-after-read with per-key TTL across memory and Redis, a non-destructive existence check so link-preview bots can't burn a secret, and a shared token system so web and React Native can't drift.
The result
A genuinely zero-knowledge product across two platforms, with a burn-on-reveal moment that makes the security tangible.
The app
Also a native app.
Built with Expo and sharing one core with the website: the same data and the same brand, no drift between platforms.
