OnceRead 📨

A secure, self-destructing message service built with Go and HTMX

OnceRead allows you to send encrypted messages that can only be read once. Perfect for sharing sensitive information like passwords, API keys, or confidential messages. Once a message is accessed, it's automatically deleted from the database forever.

✨ Features

🔒 Security First

AES-256-GCM Encryption - Military-grade authenticated encryption
PBKDF2 Key Derivation - 100,000 iterations with SHA-256
Cryptographically Secure Random - Salt and nonce generation
Environment Variables - No hardcoded secrets
Security Headers - XSS, clickjacking, and MIME-type protection
Input Validation - Comprehensive sanitization and length limits

🔥 Self-Destructing Messages

Read Once Policy - Messages automatically delete after first access
Atomic Operations - Race condition protection
No Trace Left - Complete removal from database

🛡️ Optional Password Protection

Zero-Password Mode - Send messages without passwords
Password-Protected Mode - Add extra security layer
Secure Password Handling - Never stored in plaintext

🎨 Modern Web Interface

Dark Theme UI - Beautiful gradient design
HTMX Powered - Smooth, reactive user experience
Mobile Responsive - Works on all devices
One-Click Copy - Easy URL and message copying
Tailwind CSS - Clean, modern styling

⚡ Performance & Reliability

Go Backend - Fast, concurrent, memory-safe
Supabase Database - Scalable PostgreSQL backend
Template System - Efficient server-side rendering
Lightweight - Minimal dependencies

🚀 Quick Start

Prerequisites

Go 1.23+
Supabase account (free tier available)
Git

1. Clone & Setup

git clone https://github.com/rajsibajsi/message-encrypt.git
cd message-encrypt

2. Environment Configuration

# Copy environment template
cp .env.example .env

# Edit .env with your Supabase credentials
SUPABASE_URL=your_supabase_project_url
SUPABASE_ANON_KEY=your_supabase_anon_key
PORT=8080

3. Database Setup

Create a table in your Supabase database:

CREATE TABLE messages (
    id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
    message TEXT NOT NULL,
    has_password BOOLEAN NOT NULL DEFAULT false,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- Enable Row Level Security (recommended)
ALTER TABLE messages ENABLE ROW LEVEL SECURITY;

-- Optional: Add auto-cleanup for old messages
CREATE OR REPLACE FUNCTION cleanup_old_messages()
RETURNS void AS $$
BEGIN
    DELETE FROM messages WHERE created_at < NOW() - INTERVAL '7 days';
END;
$$ LANGUAGE plpgsql;

4. Build & Run

# Install dependencies
go mod tidy

# Generate templates
go install github.com/a-h/templ/cmd/templ@latest
templ generate

# Build and run
go build -o server main.go
./server

5. Access the Service

Open your browser to http://localhost:8080

📡 API Reference

Endpoints

`GET /` - Homepage

Returns the main interface for creating encrypted messages.

`GET /alive` - Health Check

{"message": "alive"}

`GET /ready` - Readiness Check

{"message": "ready"}

`POST /store` - Create Encrypted Message

Form Data:

message (required): The message to encrypt (max 10,000 chars)
password (optional): Password for additional protection (max 1,000 chars)

Response: Returns a unique URL for accessing the message

`GET /message/{id}` - Retrieve Message

Without password: Message displayed immediately and deleted
With password: Shows password prompt

`POST /decrypt` - Decrypt Password-Protected Message

Form Data:

message (required): Encrypted message data
password (required): Password for decryption

Response: Decrypted message or error

Security Headers

All responses include:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

🔧 Configuration

Environment Variables

Variable	Description	Default
`SUPABASE_URL`	Your Supabase project URL	Required
`SUPABASE_ANON_KEY`	Your Supabase anonymous key	Required
`PORT`	Server port	`8080`

Security Configuration

Message limit: 10,000 characters
Password limit: 1,000 characters
PBKDF2 iterations: 100,000
Encryption: AES-256-GCM
Key size: 32 bytes
Salt size: 16 bytes

💻 Development

Project Structure

├── main.go                              # Entry point
├── src/
│   ├── message-encrypt/
│   │   ├── entities/
│   │   │   └── Message.go              # Message entity
│   │   ├── providers/
│   │   │   └── MessageProvider.go      # Database operations
│   │   ├── routes/
│   │   │   ├── GetIndex.go            # Homepage handler
│   │   │   ├── GetMessage.go          # Message retrieval
│   │   │   ├── PostDecrypt.go         # Decryption handler
│   │   │   └── PostStore.go           # Message creation
│   │   └── services/
│   │       └── EncryptionService.go    # Crypto operations
│   └── public/
│       ├── components/
│       │   ├── header.templ           # HTML head component
│       │   └── span_with_copy.templ   # Copy-to-clipboard component
│       └── views/
│           ├── index.templ            # Homepage template
│           └── message.templ          # Message display template
├── .env.example                        # Environment template
└── README.md                          # This file

Building from Source

# Install dependencies
go mod tidy

# Generate Go files from templates
templ generate

# Build
go build -o onceread main.go

# Run
./onceread

Development Commands

# Watch mode (requires air)
go install github.com/cosmtrek/air@latest
air

# Run tests
go test ./...

# Format code
go fmt ./...

# Vet code
go vet ./...

🚀 Deployment

Docker Deployment

FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY . .
RUN go mod tidy && go install github.com/a-h/templ/cmd/templ@latest
RUN templ generate && go build -o onceread main.go

FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=builder /app/onceread .
EXPOSE 8080
CMD ["./onceread"]

Production Environment Variables

SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=your-production-key
PORT=8080

Recommended Production Setup

Use HTTPS in production
Set up proper CORS policies
Configure rate limiting
Monitor logs and metrics
Regular security updates
Database backups

🔐 Security Considerations

Encryption Details

Algorithm: AES-256-GCM (Authenticated Encryption)
Key Derivation: PBKDF2 with SHA-256, 100,000 iterations
Random Generation: Cryptographically secure (crypto/rand)
Salt: 16 bytes, unique per message
Nonce: 12 bytes, unique per message

Security Best Practices

Messages are encrypted before database storage
Passwords are never stored (only used for key derivation)
All database operations use parameterized queries
Input validation prevents injection attacks
Security headers protect against common web vulnerabilities

Threat Model

Protects Against:

Database breaches (data is encrypted)
Network interception (HTTPS + encryption)
Unauthorized access (read-once policy)
XSS and injection attacks (input sanitization)

Does NOT Protect Against:

Compromised Supabase credentials
Client-side malware
Social engineering attacks
Physical access to unlocked devices

🤝 Contributing

Fork the repository
Create a feature branch
Make your changes
Add tests if applicable
Ensure all tests pass
Submit a pull request

Code Style

Follow Go standard formatting (go fmt)
Use meaningful variable names
Add comments for complex logic
Keep functions small and focused

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🛠️ Built With

Go - Backend language
Templ - Type-safe HTML templates
HTMX - Modern web interactions
Tailwind CSS - Utility-first CSS
Supabase - Backend-as-a-Service
Bluemonday - HTML sanitization

📞 Support

Issues: GitHub Issues
Discussions: GitHub Discussions

🎯 Roadmap

⚠️ Important Security Notice: This service is designed for sharing sensitive information securely. However, always verify the identity of recipients and use additional security measures for highly sensitive data. The developers are not responsible for any misuse or data breaches.

Made with ❤️ using Go and modern web technologies.

Name		Name	Last commit message	Last commit date
.vscode		.vscode
src		src
tmp		tmp
.air.toml		.air.toml
.env.example		.env.example
.gitattributes		.gitattributes
.gitignore		.gitignore
README.md		README.md
go.mod		go.mod
go.sum		go.sum
main.go		main.go

Latest commit

History

Folders and files

Repository files navigation