How it works

timelock.dev is a thin interface to tlock, a timelock encryption scheme built on the drand distributed randomness beacon. Nobody holds a key you need to trust us with, and nobody can open your message early, including us.

The idea in four steps

drand is a network run by the League of Entropy, a group of independent organizations. Every 3 seconds it publishes a round: a threshold BLS signature over the round number. No single member can produce it alone.
That signature doubles as a private key in an identity-based encryption scheme (Boneh–Franklin on the BLS12-381 curve), where the "identity" is the round number. Anyone can encrypt to a future round using only the network's public key.
Your message is encrypted with a random key using age (ChaCha20-Poly1305), and that key is encrypted to the target round. The output is a normal age file with a tlock recipient line: -> tlock <round> <chain hash>.
When the round arrives, drand publishes its signature. Anyone holding the ciphertext can fetch it, recover the key and read the message.

The construction is described in tlock: Practical Timelock Encryption from Threshold BLS (Gailly, Melissaris and Romailler, 2023). This site uses the drand team's tlock-js. Its output is interchangeable with tlock (Go) and tlock-rs / dee (Rust).

The network: drand quicknet

Chain hash	`52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971`
Public key	`83cf0f2896adee7eb8b5f01fcad3912212c437e0073e911fb90022d3e760183c8c4b450b6a0a6c3ac6a5776a2d1064510d1fec758c921cc22b0e17e63aaf4bcb5ed66304de9cf809bd274ca73bab4af5a6e9c76a4bc09e76eae8991ef5ece45a`
Scheme	`bls-unchained-g1-rfc9380` (unchained, signatures on G1, RFC 9380 hashing)
Period	3 seconds
Genesis	2023-08-23 15:09:27 UTC (round 1)
Relays	`https://drand.cloudflare.com`, `https://api.drand.sh`, `https://api2.drand.sh`, `https://api3.drand.sh`

Round r is published at genesis + (r − 1) × 3 s. The chain parameters above are built into the site and API, and every signature fetched from a relay is verified against the public key. A relay can delay or withhold a round, but it can't forge one.

Client-side vs server-side: who sees what

	Website (browser)	JSON API / original endpoints	Local CLI
Where encryption runs	In your browser	On our Cloudflare Worker	On your machine
timelock.dev sees your message	No	Yes, in memory during the request	No
timelock.dev sees the ciphertext	No	Yes, in memory during the request	No
drand relays see	Your IP and the round you decrypt	Our Worker's request for the round	Your IP and the round
Recorded in the feed	Event type, round, time (reported by your browser)	Event type, round, time	Nothing

Encrypting needs no network at all: the browser has the quicknet public key built in. Decrypting fetches one public signature from a drand relay.

What we store

One row per event in a Cloudflare D1 database: encrypt or decrypt, website or API, the server time, the drand round and its unlock time. That's what the public feed shows. We don't store or log plaintext, ciphertext, IP addresses, user agents or cookies, and the site has no analytics or third-party scripts. Like any site on Cloudflare, requests pass through Cloudflare's network, which processes connection data for security and abuse prevention.

Doing it yourself

For anything important, encrypt locally. With dee (prebuilt binaries for Linux, macOS and Windows):

# once: point dee at quicknet
dee remote add quicknet https://api.drand.sh/52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971

# encrypt for 30 days (also accepts a round number or a date like "2030-01-01 00:00:00")
dee crypt -a -r 30d message.txt > message.age

# decrypt once the round has passed
dee crypt --decrypt message.age

Files made this way decrypt on this site, and vice versa.

Limitations

Read these before you lock up anything that matters.

It depends on drand. Decryption needs drand to publish your round. If quicknet pauses, the message stays locked until it resumes. If the network is ever shut down before your unlock time, the message can never be decrypted. Quicknet has run since2023-08-23, but nobody can promise decades, so be careful with very long locks. We allow up to100 years.
There is no early decryption. Not for you, not for us, and not if you change your mind. There's no reset and no recovery. If you lose the ciphertext, the message is gone.
It trusts a threshold of drand operators. The scheme holds as long as fewer than the threshold of League of Entropy nodes collude. If enough of them conspired, they could compute future signatures and decrypt early. See drand's security assumptions.
The server-side API sees your plaintext. We don't store or log it, but you have to take our word for that. The website and CLI don't have this problem.
The website trusts the code we serve. Browser-side encryption protects you from us storing your message, but not from a compromised version of this site serving malicious JavaScript. For high-stakes secrets, use a local CLI.
Round granularity. Unlock times snap up to the next 3-second round. Unlocking follows drand's clock, not your device's. A wrong system clock only changes the countdown you see.
No authorship or secrecy of metadata. Anyone can encrypt anything to any round, so a ciphertext doesn't prove who wrote it or when. The unlock round and the approximate message size are visible to anyone holding the ciphertext.
Not post-quantum. The scheme relies on pairings over BLS12-381, which a large quantum computer would break.
The feed is best-effort. Website events are reported by browsers and can't be verified, so treat the counts as indicative.
Size limits. The JSON API accepts up to 64 KiB of plaintext and the original endpoints up to5 MiB. Use a local CLI for larger files.