Games / Relationships
Secret Message Lock: Answer a Question to Unlock
Leave a confession, an inside joke or a surprise behind a question. Share one link, choose the wrong-guess limit, and keep a private link to check the status.
Secret Message Lock: Answer a Question to Unlock: Send a secret message to a crush, a partner, a classmate or a friend who knows the answer to your question. Every link has one shared allowance of wrong guesses, even across browsers and devices. A correct answer reveals the message; using all the wrong tries permanently deletes the encrypted message. The private status link shows whether it was solved, how many tries were used and when it expires, and lets you delete it early. Processed securely on demand.
- Category
- Games & party
- Runs
- On TOEA's server
- Cost
- Free · no sign-up
- Availability
- Ready to use
Loading your lock…
How shared tries work
Each link has its own server counter, so guesses from different devices use the same allowance. The Cloudflare Durable Objects overview (https://developers.cloudflare.com/durable-objects/) describes the consistent storage used for this kind of shared state. The encrypted copies are deleted as soon as the limit is reached.
How the message is encrypted
A separate random salt and IV are used for each accepted answer. In your browser, PBKDF2-SHA-256 stretches the normalised answer into an AES-GCM key with 210,000 iterations. The Web Cryptography specification (https://www.w3.org/TR/WebCryptoAPI/) describes these algorithms. A random 256-bit private key stored only with the lock protects the server's answer verifiers using HMAC-SHA-256; the server does not derive encryption keys or decrypt messages. Short answers are still guessable, so this is a guessing game for light-hearted messages.
How answers are matched
Loose matching uses Unicode compatibility normalisation and case folding before ignoring punctuation and extra spacing. The Unicode Character Database (https://www.unicode.org/ucd/) describes these mappings. Spaces between Chinese, Japanese and Korean characters are ignored; exact matching preserves every character.
How to use it
- Write a question, an optional hint and up to five accepted answers, then add your message.
- Choose the number of wrong tries, answer matching and an expiry of 1, 7 or 30 days.
- Create the lock, send the share link and keep the private status link to yourself.
Privacy & limitations
The server stores the question, hint, encrypted message copies, answer verifiers and a private verification key and attempt counters until expiry or deletion. Wrong guesses are stored only if the sender switches that on. Your message is encrypted in your browser with a key made from the answer, and only the encrypted copy is stored. When you create the lock, our server checks the text for links and length without keeping it. Accepted answers are checked at creation and are not kept. No names or accounts are required.
Related tools
Frequently asked questions
How are the tries enforced?
Wrong tries are counted per link on our server. Clearing cookies, opening a private window or using another device does not reset them. Once all wrong tries are used, the encrypted message is deleted and cannot be unlocked.
Can I see what they guessed?
Only if you turned on the option to see wrong guesses when creating the lock. The recipient is told before guessing that the sender can see wrong guesses. Correct answers are never shown in the status page.
What do you store, and for how long?
We store the question, hint, encrypted message copies, answer verifiers and a private verification key, attempt counters, expiry time and a hash of your status token. Optional wrong guesses are stored only if enabled. Your message is encrypted in your browser with a key made from the answer, and only the encrypted copy is stored. When you create the lock, our server checks the text for links and length without keeping it. Answers are checked at creation and are not kept. Encrypted copies, answer verifiers and the private verification key are deleted immediately when the lock runs out of tries; status and optional guesses remain until expiry. All lock data is deleted after your chosen 1, 7 or 30 days, or when you delete it with the private status link. No names or accounts are required.
Can TOEA read my message?
Your message is encrypted in your browser with a key made from the answer, and only the encrypted copy is stored. When you create the lock, our server checks the text for links and length without keeping it. Short answers can be guessed, so don't use it for passwords or sensitive secrets.
What if I lose the private status link?
Keep it somewhere private before leaving the page. We cannot recover it, show you the status or delete a lock for you without it. The lock will still expire automatically. Anyone with this link can see the status and delete the lock.
Why aren't links allowed in messages?
Links are rejected in questions, hints, accepted answers and messages to reduce phishing and unwanted redirects. Write your message as plain text. Use Report abuse if a question or message is harmful.
Can the message be opened again after it is solved?
Yes. Return to the same share link and enter an accepted answer again before it expires. The message is only returned after a correct answer, even when the lock is already solved. Wrong re-entry attempts still use the remaining allowance.
Free tool · runs on toea's server · no account required