How it works
- You write. Your browser creates a random AES-256-GCM key and encrypts the text before it's sent.
- You set the rules. A password, shared through another channel, then a one-time read, an expiry from 1 hour to 30 days, or both.
- MedLiam only receives the encrypted version and gives you a link to share.
- The key is in the link, after the
#. The recipient's browser decrypts the message, which then disappears.
https://courriel.medliam.com/m/aB3xK9…#decryption-key
Browsers never send the part after the # to the server, which you can check in the Network tab.
What zero-knowledge means
The provider has no access to your content. Our servers only store an encrypted blob and never see the key.
So even MedLiam cannot read your expiring messages. A legal request, a server breach or a curious employee would get nothing readable.
This applies to expiring messages and PGP. An ordinary email sent to a Gmail address arrives readable at Google: it stays private on our side, with no ads or profiling, but it isn't end-to-end encrypted.
PGP for people who already use it
Expiring messages work with anyone, with no software to install. If the other person already uses standard encryption, OpenPGP is built in.
Your public key is published through WKD (Web Key Directory): Thunderbird, GnuPG or another provider can find it on their own and send you encrypted mail with no prior exchange.
When to use it
- A password, API key or code that shouldn't stay in an inbox.
- A confidential document that should be deleted once read.
- An HR, legal or medical matter.