glance.sh

Security

glance.sh is designed to be ephemeral. Images are encrypted in your browser before upload, stored in a private blob store, and deleted after about 30 minutes. It is not zero-knowledge: the share URL is the decryption key, and glance.sh decrypts when it serves that URL.

Private storage

All uploads are stored in a private Vercel Blob store. Blobs are never publicly accessible. Every request is validated and streamed through the application, which checks expiry before serving any content.

Encryption at rest

Every image is encrypted in your browser with AES-256-GCM before it leaves your device. The key is derived from the share token via HKDF. Blobs are stored at uploads/<expiry><sha256(token)>, never under the token itself, so a listing of the store reveals neither the plaintext nor the key.

Anyone with the share URL can decrypt the image — including this application. GET /<token> decrypts on the server so curl and <img> keep working. That is encryption at rest, not end-to-end encryption.

After upload, the page shows a receipt: the storage path matches SHA-256 of the token, and the uploaded bytes are an encrypted envelope, not image magic. GET /raw/<token> returns that envelope as application/octet-stream without decrypting, so you can inspect what is stored.

Automatic expiry & deletion

Every upload is assigned a short-lived token that expires within 30 minutes. After expiry, the image can no longer be accessed. Expired blobs are permanently deleted shortly after expiration.

Accounts, cookies, telemetry

glance.sh does not require sign-up and does not set cookies. Vercel Analytics and Sentry collect usage and error data. Share tokens are stripped from Sentry events before they are sent.

Link security

Uploaded images are only accessible via a URL with an embedded unique token, generated and displayed once. The random portion is 15 characters from a 62-character alphabet (~89 bits, 6215 combinations), created with node:crypto. Guessing a valid link is not practical. Only someone with the exact link can access an image, and only before it expires.

Live sessions

A live session stores share URLs in Redis for up to 10 minutes so a waiting agent can receive them over SSE. Those URLs contain the token. The session record expires with the Redis TTL.

Infrastructure

glance.sh runs on Vercel with TLS everywhere. All traffic between your browser, the application, and storage is encrypted in transit.

Reporting issues

If you discover a security vulnerability or have concerns, contact security@modem.dev.

Sub-processors

The following third-party services process data on our behalf:

Last updated: August 2026