VaporDrop

Security Ephemeral encrypted messaging over Tor. Brain-key login, zero accounts, RAM-only storage. Non-NIST cryptography throughout.

What VaporDrop is

VaporDrop is an ephemeral secure drop system for messages and files. It has no accounts, no passwords, no registration. Identity is derived entirely from a phrase you remember — a brain key. Nothing is written to disk. Messages and files auto-expire after seven days and are gone.

The service is accessible exclusively via a Tor v3 onion address. There is no clearnet interface. The transport layer is handled entirely by Tor; the application layer adds end-to-end encryption on top.

VaporDrop is free software written in Go. Source: github.com/Virebent-do-ART/vapordrop.

Brain key: identity without credentials

Traditional authentication requires storing something: a password hash, a token, a certificate. VaporDrop stores nothing. Your identity is derived on the fly from words you provide.

How it works

6+ words (passphrase)
  ↓
Argon2id (memory-hard key derivation)
  ↓
X25519 keypair (asymmetric identity)
  ↓
Ed25519 keypair (signing identity)

The same phrase always produces the same keys. To recover your identity on a new device, type the same words. There is no account to recover, no email to verify, no backup file to protect.

Argon2id is deliberately memory-hard: brute-forcing the phrase requires significant RAM and time per attempt, not just CPU cycles. A passphrase of 6 or more uncommon words is sufficient.

The derived private key is never sent to the server. The server stores only your public key and the ciphertext of your messages — it cannot derive your identity or decrypt anything.

Cryptographic stack

Function	Primitive	Note
Key derivation	`Argon2id`	Memory-hard; brute-force resistant
Asymmetric identity	`X25519`	ECDH key agreement; non-NIST
Message encryption	`XChaCha20-Poly1305`	192-bit nonce; no IV reuse risk
Hashing / integrity	`BLAKE3`	Fast, verified; non-NIST
Signing	`Ed25519`	Message authenticity; non-NIST
Onion service key	`Ed25519 (VAPOR_KEY)`	Deterministic Tor hidden service identity

No NIST curves, no AES-GCM, no RSA. The entire stack runs on Bernstein/Aumasson primitives.

Architecture

VaporDrop runs inside Docker. The Go binary holds all session state in RAM. No database, no disk writes beyond the initial container image.

Client (Tor Browser)
  ↓  Tor v3 onion (transport encryption)
VaporDrop Go binary (RAM only)
  — receives encrypted message blob
  — verifies Ed25519 signature
  — stores ciphertext in memory map, keyed by numeric ID
  — auto-expires entries after 7 days
  ↓
Recipient (fetches by numeric ID or QR code)
  — decrypts with X25519 derived key

The server never holds a key that can decrypt the content. Messages are stored as ciphertext blobs. If the server is seized or restarted, all content is gone — there is no recovery path and no backup.

File transfer

VaporDrop supports encrypted file transfers up to 1 GB, chunked for reliable delivery over Tor. Files are treated identically to messages: encrypted before upload, stored as ciphertext, expired after seven days, shared by numeric ID or QR code.

No filename is stored. The recipient needs only the numeric ID and the brain key (or a shared secret) to retrieve and decrypt the file.

Expiration and deletion

7-day TTL — all messages and files expire automatically. No manual deletion required.
Server restart — all content is lost immediately. RAM-only means no persistence across restarts.
No recovery — there is no recycle bin, no backup, no admin retrieval path. Expired means gone.
No logs — VaporDrop does not log access, IDs, or submission timestamps.

Access

VaporDrop is accessible only via Tor. Use Tor Browser to reach the onion address. No clearnet domain is planned.

Onion address (Tor Browser required): oa7ynsyxzkvfmmsfspymcma4qxxk5ibgzbogpuxvhna76oo5ggi672ad.onion

Self-hosting

VaporDrop ships with a Docker Compose file. Build requirements: Docker, Go 1.21+.

git clone https://github.com/Virebent-do-ART/vapordrop
cd vapordrop
docker compose build
docker compose up -d

Set the VAPOR_KEY environment variable to a stable Ed25519 seed to get a deterministic Tor hidden service address across restarts. Without it, a new onion address is generated on each startup.

# generate a stable key seed (store this securely)
VAPOR_KEY=$(openssl rand -hex 32)
echo "VAPOR_KEY=$VAPOR_KEY" >> .env

Run as a non-privileged user. The container needs no capabilities beyond network access. Do not expose any port publicly — access is via the Tor hidden service only.

No account. No registration. Type your words, encrypt your message, share the ID. Seven days later it never existed.

Open VaporDrop (Tor) → Source on GitHub →