Sésame Éclair
One secret, one read, zero trace: the key never leaves the link, the server keeps only an unreadable blob.
- Year
- 2026
- Stack
- Next.js · React · TypeScript · WebCrypto · WebAssembly · PostgreSQL
- Product design
- Applied cryptography
- Web development
- Application security
- Accessibility
- Multilingual SEO
- no account, no advertising
- €0
- link key, never sent to the server
- 256 bits
- simultaneous reads accepted on a single-read secretAutomated test against Postgres.
- 1 in 100
- site languages
- 7
What needed solving.
The background
Sésame Éclair is a free service for sharing single-read secrets, published by KAYZEN from Lyon. You paste in a password or a key and get an end-to-end encrypted link that disappears once it has been read or when the chosen expiry is reached. It is the sister product of Sésame, KAYZEN's password manager: Sésame keeps what must last, Éclair passes on what must disappear. The software is free but proprietary. Only the web app is online, in seven languages; the extension, the desktop and mobile apps and the command line have been developed but are not yet published.
The constraint
A password sent by email or in Slack never really disappears: it stays in histories, backups and search indexes, and anyone who one day gains access to the mailbox can read it. One-time link services exist, but some encrypt on their own servers, as the Onetime Secret page recorded on 6 October 2026 states, for example, and many reserve files, secret requests or a custom domain for a paid plan. We needed a free service with no account, whose confidentiality holds even if you do not trust the publisher.
The response
The key never leaves the link. The browser draws a random 256-bit key, encrypts the secret, then places this key after the # sign in the address, a part that browsers never send to servers. The server stores only an encrypted blob and a few dates; it hands it over once, then deletes it in the same operation. Everything else follows from this rule: the link page never contains the secret, the PIN cannot be tested by the server, and every limitation of the system is written on the site rather than passed over in silence.
The scores recorded at delivery.
Lighthouse scores for the live site. We publish them as they are: when one is low, its cause and the plan to fix it are set out below rather than glossed over.
Every design choice, and the reason for it.
The Sésame family, one accent for the brand
Navy blue #1F3B61 for headings, terracotta #B7481F for the primary action: the visual identity of kayzen-lyon.com and Sésame. The “éclair” amber #F2C14E is reserved for the logotype. The light theme is shown by default, whatever the system setting; the dark theme is the user's choice, and is remembered.
The form is the first screen
People come to this site to send a secret, not to read a presentation: the input area takes up the hero. The options are collapsed but summarised in one readable line, “1 read · expires in 24 hours · no code”, and are only expanded to change the number of reads, the expiry, the protection or the recipients.
What does not exist yet is marked as such
The Features page classes each function as “Available” or “Planned”. The Download page shows the extension, Windows, macOS, the command line, Android and iPhone as “Coming soon”, with a link back to the web app. On a security product, announcing a missing feature would cost more trust than it would earn.
Motion that does not get in the way of reading
Crisp easing curves, buttons that press in slightly when tapped, hover effects reserved for the mouse, cards that settle into place on scroll in pure CSS, with no fade, so as never to lower contrast. Everything is disabled when the system asks for reduced motion.
Project palette
Ink
#1F2937
Text
Navy
#1F3B61
Headings
Terracotta
#B7481F
Primary action
Éclair amber
#F2C14E
Logotype
Green
#1F6B48
Confirmation
Type system
Display
Outfit 800
Body text
Plus Jakarta Sans 400
The kayzen-lyon.com families, in variable versions served from the domain: the security policy allows no third-party fonts.
What's under the bonnet.
- Next.js
- React
- TypeScript
- WebCrypto
- WebAssembly
- PostgreSQL
AES-256-GCM, the key in the fragment
The content is encrypted by WebCrypto with AES-256-GCM, using a random 96-bit initialisation vector and associated data bound to the secret's identifier. Keys are derived with HKDF-SHA-256. Before encryption, the content is padded in steps (1, 4, 16, 64 KiB…) so that the server does not know its real length. The format is published, with its test vectors, on the “Cryptographic format v1” page.
A PIN the server cannot test
The code goes through Argon2id (64 MiB, 3 passes), run in WebAssembly and loaded only if a code is requested. The verifier sent to the server is computed from the code and the link key: without this key, the server can neither verify a code nor try one. It counts failed attempts and destroys the secret on the fifth try. The limitation is written on the Security page: anyone holding both the link and a copy of the database can crack a short code offline.
A single read, even with a hundred at once
A link's page, obtained by GET, never contains the ciphertext: it is only delivered after a click on “Reveal”, through a POST request. The link preview bots of Slack, Teams or Outlook therefore do not use up the read. Delivery and deletion happen in a single SQL query; a test fires 100 simultaneous reveals at a single-read secret and accepts only one. Unknown, expired, read or destroyed link: the response is the same.
No third-party scripts, a locked-down policy
Content-Security-Policy with a per-request nonce, with no unsafe-inline or unsafe-eval for scripts; only wasm-unsafe-eval is allowed, for Argon2id. connect-src restricted to the domain, frame-ancestors set to none, two-year HSTS with preload, Referrer-Policy set to no-referrer. The cost is accepted and documented: pages are rendered on every request instead of being generated statically.
Hosted in the European Union, no IP addresses in the database
The application runs on Vercel, in Paris; the Postgres database is hosted by Neon, in Frankfurt. No column contains an IP address: rate limiting relies on a non-reversible fingerprint that changes every day. Data access goes through Drizzle and standard Postgres, which keeps the host replaceable.
One cryptographic core, several clients in preparation
All the encryption lives in a single module, packages/crypto, tested against deterministic vectors. In the code, the same module already powers a Manifest V3 extension, Electron desktop apps, Capacitor apps for Android and iOS, and a command line with an MCP server. None of them is published to date: the site presents them as coming soon.
How the site makes itself findable.
One page per search intent
Five comparisons (Onetime Secret, Password Pusher, scrt.link, Bitwarden Send, Password.link), four use-case pages (agencies, DevOps, IT support, individuals), two free tools that run in the browser (password generator, strength tester) and a blog. Each comparison carries the date its data was recorded, its sources and a “Spotted a mistake? Write to us” line.
Seven languages, linked to one another
French at the root; English, German, Spanish, Italian, Portuguese and Dutch under their own prefix. Each page declares its equivalents through hreflang, with an x-default, and the sitemap lists them all. Machine translations are flagged as “under review”; for legal texts, only the French version is authoritative.
FAQPage, SoftwareApplication and llms.txt
The FAQ carries FAQPage markup; the product is declared as a SoftwareApplication with a price of €0. An llms.txt file describes to assistants what the service guarantees, but also its limitations: no external audit, proprietary software, apps not yet available.
Usable by everyone.
Since June 2025, the European Accessibility Act has required digital accessibility from a large share of online services. We build it in at the design stage rather than retrofitting it.
WCAG 2.2 AA verified on 44 pages
The end-to-end tests run axe-core at WCAG 2.0, 2.1 and 2.2 AA levels on 44 pages, in several languages, as well as on the home page in the light and dark themes. Keyboard navigation, visible focus and a skip link are listed in the accessibility statement.
Contrast checked by a test
Each pair of colour tokens has its minimum ratio, checked automatically: 7:1, AAA level, for body text and headings on a light background; 4.5:1 for secondary text, accent links and status messages, in both themes.
A statement that does not overstate
In the absence of an RGAA audit by an independent body, the accessibility statement says that the site is “non-compliant” within the meaning of the framework, even though it was designed to comply. This is the product's rule applied to accessibility: no claim without proof.
What was delivered.
- Home — create a secret, three steps, mini comparison
- Features — “Available” or “Planned”, feature by feature
- Security — primitives, threats, limitations; format v1 and test vectors
- What the server sees — the real request, displayed live
- Request a secret — encrypted drop link for the requester only
- Comparisons, use cases, FAQ, pricing, blog, tools
- Service status, transparency, what's new, roadmap
- Legal notice, terms of use, privacy, accessibility, reporting
How the project unfolded.
Foundations
Monorepo, continuous integration with static analysis, cryptographic module and format v1 with its test vectors, design tokens, architecture decisions and threat model.
Server and application
Postgres database, atomic reveal, PIN with five attempts, tracking link, scheduled purge, nonce-based security policy; creation, reveal and tracking screens.
Public site
Features, security, dated comparisons, FAQ, use cases, tools, legal pages, “What the server sees”, service status and transparency.
Going live
Actual hosting declared (Paris for the application, Frankfurt for the database), seven languages, performance budget checked on every change, layout aligned with kayzen-lyon.com.
Other platforms
Extension, desktop, mobile and command line developed on the same core; publication on the stores pending. External audit planned before version 1.0.
What we are often asked.
More of our work
Cybersecurity & cross-platform appSésame
A password manager that cannot read your passwords: the architecture was the proof.
GDPR compliance & SaaSKonsent by Kayzen
A banner vendor that audits banners is both judge and party: independence was the product.
Offensive cybersecurity & SaaSSentinel by Kayzen
Selling a security product to engineers: every claim had to be demonstrable.
The same high standards, for your website.
A free audit of your current site, a quote within 24 hours and written reasoning — like the case study you have just read. Pay in three interest-free instalments; local funding schemes checked before you sign.