Verify our encryption yourself

Takes about five minutes

Every vendor says their product is end-to-end encrypted. That claim is only worth something if you can check it, so this page shows you how — using your own browser, on your own account, searching for a value you chose. You do not need our source code, and you do not have to take our word for any step.

What you are testing

The claim is: the contents of your secrets are encrypted in your browser, and we never receive them in a readable form. If that is true, a distinctive phrase you put inside a secret should appear nowhere in the traffic your browser sends us, and nowhere in the data we hold about you.

The check

Pick a phrase we could not guess. Something long and unusual — correct-horse-battery-staple-91847 is fine. Do not use a real password; you are going to look at this value in plain sight.
Open your browser's developer tools before you start (F12, or right-click → Inspect) and select the Network tab. Turn on Preserve log so nothing is discarded as you move between pages.
Create a secret in Glassbreak and paste your phrase in as the value. Save it, and wait for the confirmation.
Search everything your browser sent. In the Network tab use the search box (Ctrl/Cmd-F within the panel) and enter your phrase. In Chrome, the global search under the three-dot menu → Search will scan every request body at once.

What you should see

Zero matches. Your phrase does not appear in any request we received, because it was encrypted before the request was built. What you will see instead, in the requests to /api/secure/teams/…/secrets, is base64 ciphertext and a set of wrapped key shares — the encrypted material we store on your behalf.

Then open the secret again in Glassbreak. It still reads back correctly. That second half matters: “we never received your data” is trivially true of a product that quietly discards it, so a verification that stops at the first step is not a verification.

A second, independent check

Request a full data export from Settings → Privacy. That export is generated from what we actually hold about you. Search the file for your phrase — it will not be there either. Your secret's contents appear only as ciphertext.

This is a stronger check than the network one, because it looks at our storage rather than at a moment in transit.

What this proves

That the version of Glassbreak running in your browser right now encrypts your secrets before sending them, and that our servers hold ciphertext rather than readable data. An employee of ours with full database access — or anyone who compelled or stole that access — could not read what you stored.

What this does not prove

We would rather state this plainly than let you discover it later.

The check above tests the code your browser ran today. Because Glassbreak is delivered as a web application, we serve you that code — so in principle a future update could behave differently, and the test you ran this morning would not catch it. This is a property of every browser-delivered encrypted product, not just ours, and any vendor claiming otherwise is overstating their position.

What we do about it:

Automated proof on every change. The same test you just ran by hand runs in our build pipeline against every release: a random marker is placed in a secret and the entire database — every text column of every table — is searched for it. A change that leaked plaintext would fail the build rather than reach you.
The test is checked for honesty too. A search that finds nothing looks identical whether encryption is perfect or the search is broken, so a companion test deliberately plants a marker in data we do store in the clear and requires the search to find it. If our instrument stops working, we learn about it.
Independent review covers the parts that need source access, under NDA, without publishing our code.

If you find something

If your phrase turns up anywhere it should not, we want to know before anyone else does. See our coordinated vulnerability disclosure policy — it carries safe-harbour protection for researchers acting in good faith. A report like that is more valuable to us than any marketing page.