Security & Encryption

Your messages can only be read by you and your recipients. Not even by us.

XChaCha20-Poly1305 Zero knowledge Swiss hosting Triple-method 2FA Outside Cloud Act
Encryption algorithm
XChaCha20-Poly1305
192-bit nonce · via libsodium
Hosting
Switzerland · Outside Cloud Act
Outside US jurisdiction
Authentication
Email · SMS · TOTP
3 two-factor methods available

Zero-knowledge principle

At EchoPass, we cannot read your messages. This is not a marketing promise - it is a technical constraint. Your messages are encrypted with a key derived from your password before being stored. We never store your password or your decryption key.

In the event of a legal request or a breach of our infrastructure, the data stored on our servers is useless without your password.

Strong authentication

In addition to your password, EchoPass offers three two-factor authentication (2FA) methods. If your password is stolen, your account stays protected. Codes are hashed with Argon2id and expire automatically.

Email code

A 6-digit code sent to your email address, hashed with Argon2id before storage. Available on all plans.

Argon2id 10 min TTL 5 attempts max

SMS code

A 6-digit code sent to your verified phone number, hashed with Argon2id. Available on Premium plans.

Argon2id 10 min TTL Premium

Authenticator app

Standard TOTP (RFC 6238), compatible with Google Authenticator, Authy and any TOTP manager. The most secure method.

RFC 6238 30s window Priority

If multiple methods are active, TOTP takes priority (TOTP > email > SMS). Code resending is limited to one attempt per minute.

Algorithms used

XChaCha20-Poly1305

Messages Files

Authenticated encryption (AEAD). The algorithm chosen by Google for HTTPS on mobile, used in WireGuard and Signal. Extended 192-bit nonce - safe even for many encryptions with the same key. Implemented via libsodium (PHP 8.3).

Learn more about XChaCha20-Poly1305 →

Argon2id

Passwords 2FA codes

Key derivation and authentication code hashing. Winner of the Password Hashing Competition (2015). Resistant to GPU and ASIC attacks thanks to its high memory consumption. A unique random salt is generated for each user.

Learn more about Argon2id →

TLS 1.3 (HTTPS)

Transport

All communications between your browser and our servers are encrypted via TLS 1.3 with automatically renewed Let's Encrypt certificates. Transport is secured as an additional layer on top of the data encryption.

Learn more about TLS 1.3 (HTTPS) →

File encryption & isolated keys

Attached files are encrypted chunk by chunk (8,192-byte blocks) before being stored on the server. Each file has its own random key, itself encrypted with your master key. Similarly, each message has its own independent encryption key.

1
Key per message
Randomly generated at creation, unique and not shared
1
Key per file
Independent from other files and messages
0
Shared keys
Each secret stays mathematically isolated
Defense in depth: if one message key were compromised, it would not allow decryption of any other message or file. Even if an attacker gains access to file storage, they cannot link a file to a user or decrypt it without the master key.

Recipient-side security

Security doesn't stop at transmission. The recipient must prove their identity before accessing the content, through a robust multi-step verification protocol.

1

Unique link per delivery

Each triggered message generates a 64-character random hexadecimal token. This link is unique, unguessable and strictly personal.

2

Identity verification by email

On first visit, an 8-digit code is sent to the recipient's email address and hashed with bcrypt. The code expires in 15 minutes. Resending is limited to one attempt per minute.

3

Double verification if phone number provided

If a phone number is associated with the recipient, double verification is required: independent email and SMS codes. Both must be validated to access the message.

4

Codes erased after reading

Once the recipient decrypts the message, all verification codes are permanently deleted from the database. The link remains valid for 365 days after triggering but codes cannot be reused.

CH

Swiss hosting & data sovereignty

Choosing Switzerland as a hosting location is deliberate. It offers a unique legal framework, distinct from both US and EU law, with some of the world's strictest data protection standards.

🇨🇭

What Switzerland guarantees

  • Outside the jurisdiction of the US Cloud Act - no US injunction can compel access to your data
  • Outside the scope of FISA 702 - no applicable US mass surveillance
  • nFADP (new Federal Act on Data Protection) - equivalent standard to GDPR, in force since 2023
  • No US parent company or subsidiary subject to US law

Why it matters

The Cloud Act (2018) allows US authorities to demand access to data held by US companies, even if the servers are physically in Europe. AWS, Google Cloud, Azure, Cloudflare - even with EU regions - are subject to it as long as the parent company is American. EchoPass uses an independent Swiss hosting provider.

Learn more about data privacy in Switzerland →

Data minimisation & GDPR

We don't keep what we no longer need. A daily automated cleanup purges temporary data according to strict timeframes. Your right to be forgotten is technically guaranteed, not just promised.

Data lifecycle - automated cleanup

D+7 Unverified accounts deleted automatically
On read Recipient verification codes erased immediately after first reading
+15 min Expired 2FA codes deleted automatically
+30 days Expired unread deliveries purged after 30 days
+90 days Activity logs (check-ins, deliveries) permanently deleted
On request Account deletion: atomic transaction - database and physical files deleted immediately and permanently
  • No third-party cookies or advertising trackers in app
  • No sharing or selling of data to third parties
  • No advertising - ever

Infrastructure

Dedicated server hosted in Switzerland
Isolated MySQL database with no external network access
SSH access via RSA key only, passwords disabled
Automated encrypted backups
HTTP security headers (HSTS, CSP, X-Frame-Options…)
No third-party cookies, no trackers

Free or Premium?

The free plan is enough to get started. Upgrade to Premium if you have multiple messages to send, multiple recipients, or want to attach files.

Free
€0
Forever
  • 1 active message
  • 1 recipient
  • Interval from 1h to 1 week
  • Up to 3 reminders
  • No file attachments
Start for free
Recommended
Premium
€24/year
or €120 lifetime
  • Up to 100 messages
  • Up to 100 recipients
  • Unlimited interval (monthly, yearly...)
  • Up to 10 reminders
  • File attachments (100 files, 50 MB max)
Try for free

Ready to get started?

Registration takes 2 minutes. Your first message is free, encrypted, and ready to be delivered when you need it.

Report a vulnerability

If you discover a security flaw, please report it responsibly. We treat all reports seriously and in strict confidence.

Contact security@echopass.app