Skip to main content

Time-Lock — seal a message until a future date

Wrap a message in an envelope this tool will not open until a target date has passed, using the Drand beacon as a public clock. Important: the lock is enforced by the app, not by cryptography — see the limitations below.

Time-Lock packages a message with a target date and the Drand round that corresponds to it. On decrypt, the tool checks that the target time has passed and that the Drand beacon has published that round before revealing the message. It is a convenient way to schedule a self-reveal — a future announcement, a note to your future self, or a sealed prediction you plan to open later.

Important limitation: this is not cryptographic time-lock encryption. The envelope's key is derived deterministically from data stored in the envelope itself, so a technically capable holder can recover the message before the target date. The date is enforced by this application's own logic, not by the mathematics. Treat it as a sealed envelope on the honor system, not as protection against someone who wants to peek early.

For a message that is mathematically impossible to open before a deadline, you need true time-lock encryption — identity-based encryption over the Drand beacon, as implemented by the tlock construction, where the decryption key is a beacon signature that does not exist until the target round publishes. That is not yet built into this tool. Until it is, do not rely on Time-Lock to keep a secret from a motivated holder of the envelope.

Frequently asked questions

Does this cryptographically prevent early decryption?
No. A technically capable holder can recover the message from the envelope before the target date. The unlock time is enforced by this tool, not by the encryption itself. Use it for scheduling and honor-system seals, not against a motivated adversary.
What is the Drand beacon used for here?
As a shared, verifiable public clock: decryption checks that the beacon has published the round matching your target time. It does not currently supply the decryption key, which is why the lock is not cryptographic.
What would make it a real time-lock?
True time-lock uses identity-based encryption where the decryption key is the Drand signature for the target round — a value that literally does not exist until that round publishes. That (the tlock construction) is a planned enhancement.
Does this work in air-gap mode?
Encryption yes. Decryption fetches the target Drand round from api.drand.sh, so it needs network access and is disabled in air-gap mode.
What should I actually use it for?
Non-adversarial scheduling: a note to your future self, a reveal you intend to publish later, a countdown envelope. For secrecy against someone holding the envelope, encrypt to a recipient key instead.