made by a human
digital time capsule
madebyahuman.global — you upload a file, it's encrypted and stored indefinitely, and the only key that can decrypt it is printed on a certificate and posted to you. Then I destroy every copy I hold.
How it works:
- Upload anything up to 10GB — video, photos, audio, documents
- File is encrypted with AES-256-GCM, per-file key, chunked so a 10GB file streams
- Two credentials go on the certificate: an access code that reaches the file, and a decryption key that opens it
- I store the access code hashed. I never store the decryption key
- Once delivery is confirmed, every copy of the key is destroyed
A database breach gives you neither the files nor the ability to read them. If the certificate is lost, nobody can recover the file — including me.
What it proves is deliberately narrow: this exact file existed on this date, unaltered, and one person holds the key. SHA-256 plus an RFC 3161 timestamp, verifiable offline whether or not I'm still trading.
Two versions: print the certificate yourself (works anywhere), or I print it on Clairefontaine card, seal it by hand and post it tracked (UK only for now).
Built with Laravel 13 and PHP 8.5 on a single DigitalOcean droplet.
The interesting constraint was printing. I can't use a print-on-demand service, because sending them a PDF with the key on it makes that vendor a complete key escrow. So I print in-house, which caps the whole business at about 100 certificates a day.
Would welcome any feedback on the positioning — I'm finding it much easier to explain to engineers than to the people who'd actually buy it.
2 Comments