The URL fragment holds the key and never reaches the server; it decrypts a sealed capability on the reader's device; links can expire, count uses, and carry an extra password; the fragment's own lock is built to resist a hundred years of a million GPUs at a million scrypt guesses a second.

It is sharing with someone who has no account, without giving the server anything.

A secret link is a URL. The part after the hash sign is the secret.

Browsers never send that part to a server. Like a note the postman never reads. So the server hosts the link and cannot open it.

The server returns a sealed capability. The fragment decrypts it, on the reader's device.

A link can expire. It can allow a fixed number of uses. It can also need a password.

The fragment is a password too. Its lock is built to take a hundred years to break, with a million GPUs each doing a million guesses a second.

Check yourself. Which part of a secret link does the server never see?