# How FREEZE Keeps Your Secrets Secure: Military-Grade Encryption Explained When you share sensitive information like passwords, API keys, or confidential documents, security isn't optional—it's critical. FREEZE (File Resource for Ephemeral Encrypted Zero-recovery Exchange) uses military-grade encryption to ensure your secrets stay secret. Here's exactly how we protect your data. --- ## The Three Layers of FREEZE Security FREEZE protects your secrets with three independent security layers that work together: ### 1. Encryption in Transit (HTTPS/TLS) Before your secret even reaches our servers, it's encrypted during transmission using industry-standard HTTPS with TLS 1.3. This prevents anyone from intercepting your data while it travels across the internet—the same security banks use for online transactions. ### 2. Encryption at Rest (AES-256-GCM) Once your secret reaches our servers, FREEZE encrypts it using **AES-256-GCM** (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode). This is the same encryption standard used by the U.S. military to protect classified information and by major tech companies to secure user data. **What makes AES-256-GCM special:** - **256-bit keys**: Provides 2^256 possible key combinations—impossible to brute force even with supercomputers - **Authenticated encryption**: Includes built-in tamper detection to prevent anyone from modifying encrypted data - **Galois/Counter Mode**: Provides both confidentiality and authenticity in a single operation ### 3. One-Time View with Zero Recovery After your secret is viewed or downloaded once, FREEZE permanently destroys both the encrypted data and the decryption keys. There's no backup, no recovery option, no "are you sure?" prompt. Once it's gone, it's gone forever. --- ## How FREEZE Encryption Actually Works When you create a secret in FREEZE, here's what happens behind the scenes: ### Step 1: Key Generation FREEZE generates a cryptographically secure 64-character random key that becomes part of your secret's URL. This URL key is never stored on our servers—only you and your recipient have it. ### Step 2: Double-Layer Encryption Your secret is encrypted using **two keys combined**: 1. **Master Encryption Key**: Stored securely on our server (never transmitted) 2. **URL Secret Key**: The unique key in your secret's link (never stored) These keys are mathematically combined using SHA-256 hashing to create the final encryption key. This means: - Someone who steals our database can't decrypt secrets (they don't have the URL keys) - Someone who intercepts a URL can't decrypt secrets (they don't have the master key) - **You need BOTH keys to decrypt anything** ### Step 3: Random Nonce Generation Each time FREEZE encrypts data, it generates a random 12-byte nonce (number used once). This ensures that encrypting the same secret twice produces completely different encrypted output—preventing pattern analysis attacks. ### Step 4: Authenticated Encryption AES-256-GCM produces: - **Ciphertext**: Your encrypted secret (unreadable without the keys) - **Authentication Tag**: A 16-byte cryptographic signature proving the data hasn't been tampered with If anyone tries to modify the encrypted data, decryption will fail because the authentication tag won't match. ### Step 5: Secure Storage - **Text secrets**: Encrypted data is stored in the database as Base64-encoded strings - **File secrets**: Files are encrypted and stored on disk with `.enc` extensions - **Original data**: Immediately deleted after encryption—only encrypted versions exist --- ## What Gets Encrypted FREEZE encrypts everything you share: ### Text Secrets - Passwords and passphrases - API keys and tokens - Configuration snippets - Sensitive messages - Personal information ### File Secrets (Up to 1GB) - Documents (PDF, Word, Excel, etc.) - Images and screenshots - Videos and recordings - Database backups - Configuration files - Compressed archives ### Combined Secrets You can send both a text message AND a file attachment in a single secret. Both are independently encrypted using the same security process. --- ## The Automatic Destruction Process FREEZE uses multiple mechanisms to ensure secrets are destroyed after one view: ### For Text-Only Secrets 1. When the recipient opens the link, FREEZE marks the secret as "viewed" in the database 2. The secret is decrypted and displayed to the recipient 3. When the recipient closes the page, FREEZE automatically deletes the encrypted data from the database 4. The URL becomes permanently invalid ### For File Secrets (or Text + File) 1. When the recipient opens the link, they see the secret details 2. The secret is marked as "viewed" (preventing duplicate access) 3. When they click "Download & Decrypt File": - The encrypted file is decrypted in real-time - The decrypted file is sent to their browser - The encrypted file is deleted from the server - The database record is permanently removed 4. The URL becomes permanently invalid ### Backup Expiration If a secret is never viewed, it automatically expires and is deleted after 7 days. This prevents abandoned secrets from accumulating on our servers. --- ## Why This Matters for IT Administrators As an IT professional, you need to know your secret-sharing tool won't become a security liability. Here's why FREEZE is safe for enterprise use: ### No Plaintext Storage Unlike some secret-sharing services that store your data in plaintext and rely solely on "security through obscurity," FREEZE encrypts everything. Even if our database is compromised, attackers get nothing but useless encrypted gibberish without the URL keys. ### Zero-Knowledge Architecture FREEZE never has access to your unencrypted secrets. The encryption happens in our application layer using keys we don't store, meaning we physically cannot decrypt your secrets even if legally compelled to do so. ### Tamper-Proof Encryption The AES-256-GCM authentication tag ensures that if anyone tries to modify encrypted secrets (for example, injecting malware into an encrypted file), decryption will fail. You can't be tricked into downloading tampered content. ### No User Tracking FREEZE doesn't require registration, accounts, or personal information. We log minimal metadata (creation time, expiration time, view time) for operational purposes, but never store identifying information beyond IP addresses for basic abuse prevention. ### HTTPS Everywhere All FREEZE pages are served over HTTPS with modern TLS configurations. Your browser automatically encrypts all communications with our servers. --- ## Common Security Questions ### "What if someone hacks your server?" If an attacker gains access to our server, they would find: - A database full of encrypted secrets (useless without URL keys) - Encrypted files with `.enc` extensions (useless without URL keys) - A master encryption key (useless without URL keys) Without the URL keys (which are never stored on our servers), the encrypted data cannot be decrypted. ### "What if you log my secret URLs?" We don't. The URL keys are generated client-side and transmitted to you. Our servers never log complete URLs. Even our application logs only store the database record IDs, not the decryption keys. ### "Can you recover a deleted secret?" No. When FREEZE deletes a secret, it's gone forever. We overwrite the database records and delete encrypted files from disk. There are no backups, no archives, no recovery mechanisms. This is by design. ### "What happens if I close the page before downloading?" For text-only secrets, closing the page triggers automatic deletion—the secret is gone. For file secrets, you must click the download button before the secret is destroyed. If you accidentally close the page without downloading, the secret remains viewable until you return (within the 7-day expiration window). ### "Is AES-256 really that secure?" Yes. AES-256 is approved by the NSA for protecting classified information up to TOP SECRET level. A brute force attack against AES-256 would require more computational power than exists on Earth. Even with future quantum computers, AES-256 remains secure with appropriate key sizes. --- ## How FREEZE Compares to OneTimeSecret While OneTimeSecret is an excellent service, FREEZE offers several security advantages: | Feature | FREEZE | OneTimeSecret | |---------|--------|---------------| | **Encryption Standard** | AES-256-GCM | AES-256-CBC | | **Authentication** | Built-in with GCM | Requires separate HMAC | | **File Support** | Up to 1GB encrypted | Limited file support | | **Combined Secrets** | Text + File in one secret | Separate secrets required | | **Open Source** | Transparent implementation | Closed source | | **Cost** | Completely free | Free tier + paid plans | --- ## Technical Implementation Details For developers and security researchers who want to verify our implementation: ### Encryption Process (Simplified) ``` 1. Generate 64-byte random URL key 2. Derive encryption key = SHA256(MasterKey + URLKey) 3. Generate 12-byte random nonce 4. Encrypt data with AES-256-GCM using key and nonce 5. Store: Base64(nonce + auth_tag + ciphertext) 6. Return URL with secret key to user ``` ### Decryption Process (Simplified) ``` 1. Extract URL key from request 2. Fetch encrypted data from database 3. Decode Base64 to extract nonce, tag, ciphertext 4. Derive encryption key = SHA256(MasterKey + URLKey) 5. Decrypt using AES-256-GCM with key, nonce, tag 6. Verify authentication tag 7. Return plaintext to user 8. Delete encrypted data permanently ``` ### Security Properties - **Confidentiality**: AES-256 encryption with 256-bit keys - **Integrity**: GCM authentication tag prevents tampering - **Forward Secrecy**: Each secret uses unique random keys - **Zero Recovery**: Deleted secrets cannot be restored - **Side-Channel Resistance**: Constant-time operations where possible --- ## Best Practices for Using FREEZE To maximize security when sharing secrets via FREEZE: 1. **Use separate communication channels**: Share the FREEZE link via a different method than you tell the recipient about it (for example, text the link but email that you sent a link) 2. **Verify the recipient viewed it**: Check with your recipient that they successfully accessed the secret 3. **Don't reuse secrets**: Create a new secret for each share—never screenshot or copy secrets to reuse later 4. **Use HTTPS everywhere**: Always access FREEZE via `https://` (never `http://`) 5. **Trust your connection**: Only create secrets from trusted networks—avoid public WiFi when sharing highly sensitive information 6. **Combine with other security**: FREEZE is one layer of security—still use strong passwords, 2FA, and other security best practices --- ## Try FREEZE Today FREEZE is completely free and requires no registration. Share passwords, API keys, configuration files, and sensitive documents with confidence knowing they're protected by military-grade encryption. **Start sharing secrets securely at [iceboxsoftware.org/freeze](https://iceboxsoftware.org/freeze)** --- ## About Icebox Software FREEZE is built and maintained by Icebox Software, a developer of professional IT tools for system administrators. We believe in transparency, security, and practical solutions that make IT professionals' lives easier. **Questions about FREEZE security?** Contact us at info@iceboxsoftware.org