How OurSecretPhrase actually works.
The full technical picture, for anyone who wants to look under the hood before trusting it with their family.
Your secret never touches our servers
When two people pair, their devices establish a shared secret directly with each other — either by one device showing a QR code the other scans (the secret rides inside the QR payload itself, device to device), or, when scanning together isn't possible, via a real elliptic-curve Diffie-Hellman (ECDH, P-256) key exchange over Web Crypto, using a 9-digit code purely as a rendezvous lookup key. In both flows, our server only ever sees enough to introduce the two devices to each other — never the secret itself.
This means we cannot hand your secret to anyone, including ourselves, under any circumstance — and it means if you lose every device that had it, we cannot recover it for you either. That trade-off is deliberate.
The rotating phrase
From that shared secret, each device independently computes the same short phrase (like 'Seven Steady Foxes'), derived from the secret plus the current time window. The phrase changes every two minutes. An attacker who overhears or records a phrase gains nothing — it's already useless a couple of minutes later, and there's no way to predict the next one without the secret itself.
Message signatures
For texts and emails (not just live calls), OurSecretPhrase can generate a signature — six hyphenated words — that encodes both the current phrase and a timestamp. The recipient pastes it back in, and the app independently recomputes what that signature should have been for that exact moment, entirely offline from the shared secret already on their device.
Domain safety check
At signup, we run a lightweight automated check on the new account's email domain: whether it can receive mail at all, whether it matches a known disposable-email service, and how long the domain has been publicly registered (via WHOIS). Brand-new or disposable domains are flagged 'Risky'; domains we can't fully verify are flagged 'Questionable' rather than assumed safe. This runs once, at signup, and the result is visible to anyone who later pairs with that account.
Email re-verification
We verify your email when you sign up, and again roughly every 7 days — if it lapses, you're prompted to reconfirm before you can keep using the app. This is what lets your contacts trust that the email attached to your account is real and current, not just typed in once and abandoned.
Device revocation
Every device you've ever used is listed under Account → My devices. Losing a phone doesn't mean losing your security: revoking that device from any other logged-in device instantly invalidates its session and every connection it had, even if someone else unlocks it afterward.
Photo uploads
If you upload a profile photo, we don't store your original file. We decode it, validate it's genuinely an image, crop and re-encode it from scratch server-side, which strips any hidden metadata (like embedded GPS location) and neutralizes file-format tricks — before ever saving or serving it.
No ads, no selling data
OurSecretPhrase doesn't run advertising, and we don't sell data to anyone. We use cookies for sign-in and, going forward, anonymous analytics — see our Privacy Policy for the full picture.
Found a vulnerability?
Please report it responsibly to security@oursecretphrase.com rather than publicly, and give us a reasonable window to fix it. We take this seriously and appreciate the help.