June 2, 2026
Lock box, hot takes
Show HN: DropLock – E2EE secret sharing web app with no backend
A secret-sharing tool drops with big hype, cautious questions, and instant nerd applause
TLDR: DropLock is a new browser-based tool for sharing secrets without storing them on a backend server, but it comes with clear safety caveats. The community reaction was a mix of impressed praise and instant scrutiny, with fans loving the idea and skeptics drilling into how safe the browser storage really is.
A tiny Show HN post just sparked the kind of reaction tech people love: half impressed applause, half suspicious squinting. DropLock is pitching a simple but juicy promise — send private secrets in a way that stays in the browser, with no central vault holding the goods. In plain English, the app tries to let people share sensitive info without parking it on a company server, and that immediately won fans who were ready to cheer the concept alone.
The loudest mood in the room was basically: "Wait, this is actually kind of brilliant". One early commenter called it a “very cool idea” and seemed genuinely shocked nobody had built it sooner, which is basically Hacker News for why didn’t I think of that? Another chimed in with a breezy stamp of approval: nice idea, nice way to share secrets. So yes, the launch got a warm welcome — but not a free pass.
Because this is the internet, the applause came with a side of security side-eye. The app openly admits it hasn’t been reviewed by a security expert, and one commenter immediately zeroed in on the nerdy-but-important question: where exactly is the private key being stored? That was the closest thing to drama here — less flame war, more intense detective energy. No giant meme avalanche, but the vibe was classic comment-section theater: excitement, caution, and the eternal tech-community love language of asking one extremely specific question that changes the whole mood.
Key Points
- •DropLock uses a browser-generated public/private key pair, with the public key included in a lock box link.
- •The private key is stored as a non-extractable key in the browser, limiting secret access to the same browser profile that created the lock box.
- •Each device or browser has its own separate lock box.
- •Secrets are encrypted locally using an AES-GCM key derived with HKDF-SHA-256 from the recipient's public key and a one-time key.
- •The app does not use fingerprint checking and explicitly warns that it has not been reviewed by a security expert.