SchlüsselBot
I built SchlüsselBot because I was tired of sending passwords and contract documents by email — knowing they would sit there unencrypted for years.
The idea
Email is like a postcard: it sits on every server it passes through and stays in the mailbox until someone clears it out. For a password, a payslip or a scan of an ID card, that is the wrong channel. The alternatives were either too cumbersome (the recipient has to create an account) or too opaque (some provider holds the key). SchlüsselBot does both differently: no sign-up for the recipient — and a key that nobody but the two parties ever sees.
What SchlüsselBot does
- Send without an account — write a message or attach a file, send the link, done. The recipient needs no registration.
- A secure inbox for the other direction — one permanent link through which clients, patients or applicants send documents to you, encrypted.
- Open once, then gone — after retrieval or once the deadline passes, the transfer deletes itself.
- Passkey instead of password — recipients identify themselves with Face ID, a fingerprint or their device PIN.
- Embeddable in your own website — the form can be included as an iframe, in your own layout.
- Data processing agreement under Art. 28 GDPR in the business plan, for everyone handling other people’s data professionally.
The technology behind it
The decisive part does not run on the server but in the browser: the content is encrypted there with AES-GCM, the key derived from the password via PBKDF2. Only then does anything go out onto the network. On the server — a PHP application with its own process pool, data in SQLite — there is nothing but ciphertext.
In plain terms: I cannot read what anyone sends through SchlüsselBot, even if I wanted to. The key never leaves the sender’s device. Sign-in uses WebAuthn, so passkeys — there is no password that could be shared or intercepted. The server is located in Germany.
Who it is for
For tax advisors, law firms, medical practices, HR departments, IT service providers and estate agents — anywhere confidential documents go back and forth every day and email is really too insecure. And for everyone else who simply needs to send a password without leaving it in a chat history.