Doc. CYL-LP-02 · Product schematic
Precision-engineered for secrets that must not linger
Cylockr lets you share passwords and credentials securely through single-use encrypted lockers. Put a secret in, send the one-time link and passphrase separately, and the locker can be opened exactly once before it is emptied for good.
AES-256-GCM envelope encryption · one-time retrieval · automatic purge
- 1AES-256-GCM envelopeFRESH DEK PER LOCKER
- 2Opens onceSINGLE RETRIEVAL
- 3Purges on collectionCONTENT NULLIFIED
- 424hrs default expiryUP TO 2 WEEKS ON TOP PLANS
Fig. 1
The encryption line
Every secret runs the same production line before anything touches a disk. This is envelope encryption drawn end to end: one data key per locker, wrapped twice, with the outer key held in an HSM-backed vault.
- INPUT01INPUT
Secret
Your credential, in plain text for the last time.
- ENCRYPT02ENCRYPT
AES-256-GCM
Encrypted under a fresh random data key (DEK). One key per locker, never reused.
- WRAP 103WRAP 1
Passphrase key
The DEK is wrapped by a key derived from the passphrase: PBKDF2-HMAC-SHA-512 with HKDF domain separation.
- WRAP 204WRAP 2
RSA-4096 KEK
Wrapped again by a key-encryption key held in an HSM-backed vault.
- AT REST05AT REST
Ciphertext only
All we ever store. No plain text, anywhere, at any point after station 02.
Without the passphrase, the stored keys cannot unwrap the data key. The passphrase itself is never stored, so the ciphertext we hold stays ciphertext.
Fig. 2
The lifecycle
A locker has one working state and two terminal states. Opening and emptying are the same moment: the instant the recipient opens the locker and collects the secret, the content is purged. A locker that reaches its expiry is purged immediately.
Created, encrypted and waiting. The only state a locker lives in.
The recipient opens the locker once and collects the secret. The content is purged at that exact moment.
Nobody opens it in time: 24 hours by default, up to 2 weeks on top plans. The moment it expires, the content is purged.
However a locker's story ends, opened or expired, the outcome is the same: the secret is purged from our database, permanently.
Fig. 3
The two channels
A locker needs both the link and the passphrase to open. Best practice is to route them separately, so no single intercepted channel ever carries enough to open it.
The link
A unique URL. Email it, message it, send it however you like.
The passphrase
Sent via Signal, read out over the phone, or by any second channel.
The locker
Opens only where both channels meet: the recipient, who needs no account.
Send the link and the passphrase through different channels. For example, email the link and send the passphrase via Signal (or read it out over the phone).
Plain English, no figure
Why not just email it?
Credentials aren't things you should ever be able to find with Ctrl + F.
A permanent channel
- The secret replicates. It lands in the inbox, the thread, and every device that syncs them.
- Backups and search indexes keep copies long after everyone has forgotten it was ever sent.
- Forwarding is one click, and you will never know it happened.
- You cannot un-send it. The channel did exactly what it was designed to do.
A locker exists to be emptied
- One unique link, one passphrase, one retrieval. Then nothing.
- The instant the secret is collected, the content is purged. There is nothing left to forward, index or back up.
- Never opened in time? It is purged at expiry: 24 hours by default, up to 2 weeks on top plans.
- Recipients need no account. Send a locker to anyone.
And the generic one-time tools?
Most paste-a-secret sites store a bare passphrase hash next to an encrypted blob and call it a day. That is a padlock icon, not key management. Cylockr runs a real encryption line: a fresh data key per secret, wrapped twice, with the outer key in a HSM-backed vault it never leaves. And for organisations that want that vault to be their own, a Bring Your Own Vault add-on is on the way: your keys wrapped in your vault, with a master switch only you hold.
Real key management
AES-256-GCM under a fresh DEK, wrapped by a passphrase-derived key and again by an RSA-4096 KEK in an HSM-backed vault.
Sovereign by design
Your lockers live in Australian data centres. Data sovereignty is on the drawing, not an add-on.
Built for teams and machines
Organisation plans with per-user quotas and rate limiting, plus a full REST API for creating lockers from your own systems.
Table 1 · Plan summary
Clear plans, predictable pricing
Baseline security is identical on every plan. Plans differ on quota, expiry ceilings and delivery, never on encryption.
Personal
FromA$5per month
For anyone who keeps being handed passwords over text and email.
- Starter
- A$5
- Plus
- A$8
- Pro
- A$12
Organisation
FromA$19per user / month
Team management, organisation-wide policy and higher expiry ceilings.
- Team
- A$19
- Business
- A$24
- Enterprise
- A$45
Integration
FromA$300per month
A full REST API. Create lockers from your own systems and workflows.
- API base licence
- A$300
- Locker volume
- metered
ALL PRICES AUD INCLUDING GST · PERSONAL & ORGANISATION ANNUAL IS 10X THE MONTHLY RATE (TWO MONTHS FREE) · INTEGRATION MONTHLY ONLY
Want the full plan comparison, add-ons like Single Sign-On, and answers to common questions? Read the appendices.
End of drawings
Stop pasting secrets into chat and email
The next password you share can be collected once and gone, instead of sitting in an inbox forever. It takes about a minute to send your first locker.