Open memories only when time says so.

Secure, time-locked data storage powered by drand's mathematical certainty. Encrypt your future today without a central authority.

Create a Capsule

Capsule Status

hourglass_top Time-Locked

ACTIVE

Target Round 4,520,000

Network Chain quicknet

Estimated Unlock Oct 12, 2028

ROUND_ACTIVE: 4,412,892 SIG: 8f3a...b2c1 TIME_REMAINING: 1,421d 04h 22m ROUND_ACTIVE: 4,412,892 SIG: 8f3a...b2c1 TIME_REMAINING: 1,421d 04h 22m

How it Works

Three simple steps to lock your data in time.

calendar_today

1. Choose your unlock time

Select a specific future date or a specific drand round for decryption.

encrypted

2. Upload & Encrypt

Your data is secured using drand threshold signatures and optional passwords.

ios_share

3. Share or Store

Keep your time-locked capsule or share the link with your future self.

Highlights

Built for absolute security and privacy.

verified_user

Impossible to Open Early

Mathematical certainty via drand protocol.

security

Two-Layer Security

Drand threshold + personal password.

visibility_off

Zero-Trace Previews

In-memory decryption for secure media viewing.

folder_zip

Multiple File Types

Support for BTC keys, media, and docs.

Why it’s impossible early

Our protocol utilizes drand signatures to ensure that decryption keys are only generated at the specified network round.

Traditional encryption relies on someone holding a key. We rely on the Universe. A threshold of nodes must collaborate to reveal the randomness required for your specific capsule's key, making premature access mathematically impossible.

Identity-Based Encryption (IBE) on BLS12-381
The identity is a future drand round r. For round r we compute:
```
Q = H1(round || chain_hash)   // map to G2
C = IBE.Encrypt(mpk, Q, message)
```
The key does not exist yet
The decryption key for round r is the BLS threshold signature σᵣ = H1(r)^sk, where sk is split across the drand committee. No single party — and no coalition below threshold — can produce σᵣ early.
Verification is public
Once the network emits round r, anyone can verify σᵣ with the chain public key. Decryption then follows: M = IBE.Decrypt(σᵣ, C).

drand Overview arrow_outward Developer Docs terminal Timelock Encryption arrow_outward

// Drand Threshold Decryption
const round = await drand.getRound(targetRound);
const signature = round.signature;
if (signature) {
  const capsuleKey = deriveKey(signature, salt);
  const data = decrypt(encryptedBlob, capsuleKey);
  console.log("Memory Unlocked.");
} else {
  throw new Error("Time has not yet arrived.");
}