How Until Then works
Short, honest answers to the questions people ask most. If you want the full threat model, read the Security page.
The basics
What is Until Then?
A dead man's switch for files. You seal a file now, choose what should release it, and we keep it locked until that moment comes. If you go quiet, or a group you trust decides the time is right, the file opens for the people you picked. Until then, no one can read it. Not even us.
When would I use it?
When something should surface only if you are not around to handle it yourself. A letter to family, account access for next of kin, source files for a journalist, documents meant to open on a set date. Anything you want held safely without trusting a company to hold the actual contents.
Do I need to understand crypto to use it?
No. To create a safe you connect a wallet (Petra, on Aptos) and sign a couple of messages. That is the whole setup. The people who receive your file usually need nothing at all. They click a link and the file decrypts in their browser.
How encryption works
How is my file encrypted?
It happens entirely in your browser, before anything is uploaded. We generate a random key and encrypt the file with AES-256-GCM, the same standard used to protect sensitive data across the industry. The plaintext never leaves your device. What gets uploaded is ciphertext: a scrambled blob that is useless without the key.
So where does the key go? This is the important part.
The key is split into two halves, and no single party ever holds both. One half is locked by your condition, either a time-lock or a group of signers. The other half is wrapped so that only your chosen recipient can unwrap it. The file opens only when both halves come together, and that can only happen once the condition is met. Our servers store the locked pieces, never a usable key. Dump our entire database and you still cannot decrypt a thing.
What is AES-256-GCM, in plain words?
A well-tested, widely trusted way to scramble data so it can only be read with the right key. The 256 is the key size, far beyond what brute force can reach. The GCM part also checks the file has not been tampered with: change a single byte of the ciphertext and decryption fails rather than handing back something altered.
Can someone break the encryption?
Not by attacking the math. AES-256 does not get brute-forced. The real risks live elsewhere, like a compromised device while you encrypt, or a recipient's email account being taken over so someone else clicks their link first. We lay those out plainly on the Security page.
How decryption works
What happens when the condition is met?
The recipient gets a one-time link. Opening it pulls the ciphertext from storage along with the now-unlocked key material, reassembles the key in their browser, decrypts the file locally, and hands them the download. The decryption runs on their device. We never see the key or the file at any point.
Why is the link single-use?
So a leaked or forwarded link cannot be replayed. The first time a private link is opened, it burns. Every later attempt gets the same “no longer valid” answer. Open it when you are ready to keep the file, and save it right away.
Do recipients need a wallet or an account?
For most safes, no. Email recipients just click the link and download. Some safes are addressed to a wallet instead, for extra protection, and those ask you to connect that wallet and sign once so your half of the key unwraps. The link tells you which kind it is.
Conditions
What is a time-lock?
You pick a date and time. The key stays locked until then, enforced by drand, a public randomness beacon that publishes a value on a fixed schedule. No one can pull that value forward, us included. When the round arrives, the lock opens on its own. You can push the date out anytime before it, with one quick signature and no fee. If you never do, it releases automatically. That is the dead man's switch.
What is a trusted circle?
Instead of a clock, a group of people you name controls the release. You set how many must approve, say two of three. The safe stays sealed until that many of them actively approve. It never fires on its own. Use it when a human judgment call should decide whether the moment has come, not a calendar.
What is the difference between private and public?
Private means specific recipients, each with their own one-time link. Public means a single shareable link that anyone holding it can open after release. That choice is separate from what releases the safe, so you can mix and match: a public time-lock, a private trusted circle, and so on.
Setting up a trusted circle
How does a trusted circle work, step by step?
Three steps. First, each signer registers their wallet once: you send them a registration link from the setup screen, they open it and sign. Second, once all of them have registered, you can arm the safe. Third, when the group decides the moment has come, each signer opens their approval link and signs. The file unlocks as soon as enough of them approve.
Why do signers have to register before I can arm?
To seal a file to a group, the app encrypts a piece of the key to each signer. It can only do that once it has each signer's key, which they hand over by registering. So registration comes first and arming second. Until everyone has registered, the Arm button stays disabled.
Does each signer register again for every safe?
No, just once per wallet. After someone registers, any future safe that names that wallet can be armed right away, with no repeat. You only wait on a signer the first time you add them.
How do the signers know when and where to approve?
When you arm, each signer is emailed their own approval link automatically. They sign to approve whenever the group agrees it is time, which may be much later. From the safe page you can see who has approved so far, resend a link, or copy it to send yourself.
Can a signer register on one device and approve on another?
Yes. The signer key is never stored on the device you register from. It is recomputed from your wallet signature whenever it is needed, so any device signing with the same wallet produces the same key. Register on a laptop and approve from a phone, and it works, as long as both use the same wallet account. There is nothing to export or move between devices.
What if a signer can't be reached?
The safe stays sealed. It opens only when your required number of signers approve, so nothing is released until the group acts. If someone who has never registered is unreachable, you cannot arm a safe that includes them, because there is no key to seal their share to. The fix is to have each signer register once, early, while they are around.
Managing a safe
Can I change or cancel a safe after sealing it?
You can postpone a time-lock anytime before it releases, and you can delete a safe outright. You cannot edit the file or the recipients after sealing, because the encryption is bound to them at creation. If you need a change, delete it and create a new one.
Where is my file actually stored?
The ciphertext lives on Shelby, a decentralized storage network on Aptos. We only ever put encrypted bytes there. Your wallet pays the storage cost directly, so the file sits in your own namespace, not ours.
Is there a size or file-type limit?
Any file type works, and there is no fixed size limit. Very large files just take longer, since everything is encrypted in your browser before it is uploaded.
What does it cost?
You pay small network fees for storage and for on-chain actions like sealing, postponing, or approving. There is no subscription, and we never take custody of your file.
Trust and limits
Can you, the operator, read my file?
No, and that is the whole point of the design. We never hold a usable key, and the plaintext never reaches us. If we were hacked, subpoenaed, or simply went rogue, there is nothing on our side to decrypt. The full list of what we can and cannot protect against is on the Security page.
What happens if Until Then goes away?
Your file is ciphertext on a decentralized network, and the unlock for a public time-lock is pure drand math that anyone can compute. The code is published and the retrieval pages are open, so the path to decrypt does not depend on our servers staying online.
How do I know the code has not been tampered with?
This is the one thing you trust alongside your own device: the code we serve you. We publish the source so you can read exactly what runs, and the bundles carry integrity hashes you can check against it. A browser crypto app can never rule this out completely, but we make it verifiable instead of asking you to take our word.
Still unsure about something? The Security page goes deeper on the threat model, in the same plain language.