Message lifecycle
What Happens After a Message Is Opened?
What opening a current Collogue link does and does not change.
Published: July 26, 2026
Current implementation boundary
Current Collogue links carry the encrypted payload in the URL. The browser uses Web Crypto API: PBKDF2-SHA-256 with 310,000 iterations derives a 256-bit AES-GCM key from the separately entered password, with a random 16-byte salt and a 12-byte IV. The current client has no application API request for creating, retrieving, or storing messages.
The password is not encoded in the link. The implementation does not provide one-time viewing, server-side deletion, or an expiry timer. Treat the full link as sensitive and share the password through a separate channel.
Further context
“Self-destructing message” is a memorable phrase, but it does not describe the current implementation. Opening a link decrypts the encrypted payload locally; it does not consume, delete, or expire the link.
Do not write that a message vanishes from the internet. The encrypted payload remains in the URL until the holder stops keeping or sharing it.
Once decrypted, plaintext exists on the recipient’s device.
- page memory;
- the rendered document;
- the clipboard if copied;
- accessibility tools;
- browser screenshots or tab previews;
- crash reports;
- extension-accessible page content;
- operating-system swap or diagnostics.
The application can reduce unnecessary persistence. It cannot guarantee forensic erasure from a general-purpose device.
Failure handling is part of the lifecycle.
A privacy-preserving design can still create frustrating data loss if it consumes messages too early. A reliable design can expose messages longer if it waits too long.
There is no honest substitute for documenting the chosen behavior.
If a link and its separately shared password may both have reached the wrong person, the sender should treat a credential as potentially exposed.
- change a temporary password after first login;
- rotate a token when the task is complete;
- revoke unused credentials;
- enable MFA;
- avoid reusing the same secret elsewhere;
- record the operational action, not the secret itself.
A temporary delivery mechanism works best with a temporary secret.
Yes. Once readable text appears on a device, the service cannot reliably prevent screenshots, photographs, copying, or transcription.
If a message cannot be decrypted, check that the complete URL and the correct password were used. An incorrect password, an altered URL, or damaged ciphertext can all prevent decryption. Treat access credentials cautiously if both pieces may have been disclosed.
Create a private Collogue link when you need to send a password, token, recovery code, or another short piece of sensitive text.