How it works

For the curious, and for anyone who needs to open a capsule without this site.

The public time signal

drand is a public randomness service run by the League of Entropy, a group of independent organisations (universities, companies and foundations). Its “quicknet” network publishes a new value, called a round, every 3 seconds. Each round is a BLS signature that the members make together: no single member, and no small group of them, can make one on their own, early or late. drand is not a blockchain and has no currency. It is a shared signature anyone can check.

Locking a letter to a date

Timelock encryption (tlock) uses a property of these signatures: anyone can encrypt something so that only the signature for a chosen future round will decrypt it, using nothing but the network’s public key. Nobody has that signature until the round comes, not you and not us. So your browser:

1. puts your letter and photos in a zip file (letter.txt, capsule.json and photo-1.jpg onwards);
2. works out the first round at or after the time you picked (it is never earlier, which is why the time is “about”: rounds are 3 seconds apart);
3. encrypts the zip to that round with drand’s own library, tlock-js, which writes the same file format as drand’s command-line tool, tle: an age file whose key is locked to the round.

None of this needs a network connection. The page then puts the encrypted file into the link, after the #, a part of a link that browsers never send to a server. The round number goes in the visible part of the link (/o/<round>) so a chat app’s preview can show the date; the letter never does.

A message with a link fits a chat for letters of up to about 800 words (we keep the whole message under 4,000 characters). A longer letter, or any capsule with photos (up to 5, 5 MB in all), travels as a file instead. We don’t store capsules.

Opening it

Before the round, the page shows the date and a countdown, and asks nobody anything. On the day, it asks our server for the round. Our server fetches it from two of drand’s public servers (api.drand.sh and drand.cloudflare.com) and passes it on only if both agree, so drand’s operators never learn who opens which capsule. Then your browser checks the round’s signature itself against quicknet’s public key, which is built into the page, so neither our server nor drand’s can hand it a false round. If the signature is right, it decrypts the zip and shows what’s inside.

Opening a capsule without this site

Every layer is a published format with someone else’s tool, so a capsule can be opened if this site is gone. You need drand’s tle (from github.com/drand/tlock/releases) and any unzip.

From a file you were sent:

tle -d capsule-2027-02-14.age > contents.zip
unzip contents.zip

From a link: copy everything after #c=. It is the same file in base64url (RFC 4648, without padding). Decode it to a file, for example with Python:

python3 -c "import base64,sys; s=sys.argv[1]; open('capsule.age','wb').write(base64.urlsafe_b64decode(s+'='*(-len(s)%4)))" 'PASTE-HERE'
tle -d capsule.age > contents.zip && unzip contents.zip

tle fetches the round from drand itself and checks it. The network is quicknet, chain hash 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971, which tle uses by default.

Who can open it, and when

• Before the round: nobody, unless enough of drand’s members broke their rules together.
• After the round: anyone who has the link or the file. That includes a chat service that keeps your messages, if the chat isn’t end-to-end encrypted. Send it only where you’d send the letter itself on the day.
• We never have the link or the file, so we can’t open it, before or after.

Why months, not decades

A capsule opens only if drand still publishes its round. drand has retired a network before (its first fast network, “fastnet”), and its members could stop. So the longest lock offered is 366 days, and we say plainly that a capsule may never open if the signal stops.

What has been checked

• drand’s tlock and tlock-js were reviewed by Kudelski Security in 2023 (drand’s summary). The version this site uses, tlock-js 0.9.0, came later.
• Our tests open capsules written by drand’s tle, and tle opens capsules this site writes, including one with a photo. They also check that a forged round, a round from another network, a round that hasn’t happened yet and any altered byte are all refused.

What we keep, and what we don’t.