Sealed and opened in your browser — your text, your file and your recovery code never leave it.

Sealed capsule

Seal something now so that no single key holder can open it before a moment you choose.

format: beattime-seal-v1 · sealed in your browser

This page does the sealing, not the server. The text, the file, the master secret and the recovery code are produced here and stay here — there is no endpoint that would accept them. What the service publishes is the public half: the chain parameters, the operator registry and the shares that are released once their moment has passed. The format is described in full under time-sealed envelopes.

1What goes in

A message, or a file. The name and type of a file are encrypted together with it — the envelope itself gives nothing away.

Choose a file

2When it opens

Your local time. It is stored as a @beat index — one number, the same everywhere on Earth, with no timezone to get wrong.

3Who holds the keys

The key is split so that no single holder can open the capsule alone — including us.

Standard drand, one key server, and a recovery code you keep. Any two of them open it. The recovery code covers you if an operator disappears. On its own it does not open the capsule early, but whoever holds it needs just one more share — keep it apart from the capsule file. Strict drand and one key server, no recovery code. Nothing to lose and nothing to steal — and nothing to fall back on. Resilient drand, every registered key server and a recovery code — any three of them open it, so opening it early takes three parties together. With two key servers it survives losing any one share; if both key servers disappear, it cannot be opened (Standard would still open with drand and your code). With three or more key servers it survives losing any two shares.

Nobody holds the key alone

drand · League of Entropy

A public threshold network run by independent organisations, including Cloudflare, Protocol Labs and EPFL. It signs a new round every 3 seconds; the signature that unlocks your capsule does not exist until your moment.

Sigelith Key · beat-key

Our own key server releases its share only after the moment has passed. It is open source (Apache-2.0), with reproducible builds and signed releases — anyone can rebuild it and compare.

An independent operator

A second key server run by Konveria in Kraków — an independent company with no personal or capital ties to us, which also publishes our Android apps on Google Play — on another hosting provider, in another country. Two shares never share an owner or a hosting provider.

Your recovery code

Stays with you. It stands in for one key holder if an operator ever disappears — on its own it never opens a capsule early.

Live right now: drand quicknetSigelithbeatkey-konveria

Capsule format Operator registry beat-key source code

Keep the capsule file. It is the only copy — nothing about it is stored on this site. Back it up the way you would back up a photograph you cannot retake.

Once a moment has passed, the shares that open capsules for it are ordinary public data. Anyone can fetch, mirror or archive them, and the operators are in neither the trust path nor the availability path. That is what makes a capsule outlive the service that made it.