How OurSecretPhrase actually works.
The full technical picture, for anyone who wants to look under the hood before trusting it with their family.
Your secret never touches our servers
When two people pair, their devices create a shared secret directly with each other — by scanning a QR code, exchanging a 9-digit code, or accepting an email invite. In every case, our server only ever helps the two devices find each other; it never sees the secret itself.
That means we can't hand your secret to anyone, including ourselves — and if you lose every device that had it, we can't recover it either. That trade-off is deliberate.
The rotating phrase
From that shared secret, each device independently computes the same short phrase (like 'Seven Steady Foxes'). It changes every two minutes, so an overheard or recorded phrase is useless within minutes — and there's no way to predict the next one without the secret.
Message signatures
For texts and emails to someone you're already paired with, OurSecretPhrase can add a six-word signature that encodes the current phrase and a timestamp. The recipient pastes it back in, and the app recomputes what it should be for that exact moment — entirely offline.
Signing to someone you're not paired with works differently: the signature is an opaque code tied to your verified account, checked against our server rather than recomputed offline — the tradeoff that makes it possible to verify a total stranger, not just an existing contact.
Domain safety check
At signup, we automatically check the account's email domain: whether it can receive mail, whether it's a known disposable-email service, and how long it's been registered. New or disposable domains are flagged 'Risky'; anything we can't verify is flagged 'Unverified.' This runs once, at signup, and the result stays visible to anyone who later pairs with that account.
Email re-verification
We verify your email at signup, then again roughly every 7 days — if it lapses, you're asked to reconfirm before you can keep using the app. This is what lets your contacts trust the email on your account is real and current.
Device revocation
Every device you've used is listed under Account → My devices. If you lose a phone, revoke it from any other logged-in device — that instantly ends its session and every connection it had, even if someone else unlocks it.
No ads, no selling data
We don't run ads, and we don't sell your data. We use cookies for sign-in and anonymous analytics (Google Analytics) — see our Privacy Policy for details.
Found a vulnerability?
Report it responsibly to security@oursecretphrase.com rather than publicly, and give us reasonable time to fix it. We take this seriously and appreciate the help.