How LettersBox protects your account and what you write, and how to report a problem.
Your account
- Passwords are stored only as a strong one-way hash, never in a form that can be read back.
- Passkeys let you sign in with your device's fingerprint, face or PIN instead of a password. Only the public half of the key is stored.
- Two-step verification (an authenticator app or an email code) can be turned on in Settings → Security, with backup codes for when you lose your phone.
- Sign-in attempts are rate limited, so passwords and codes cannot be guessed quickly.
- Sign in only at lettersbox.ir. We will never ask for your password or a sign-in code by email, chat or letter.
Your notes
- Private notes are not listed anywhere, but anyone with the address can open them. For a note meant for one person, add a password: it is stored only as a one-way hash and must be entered before the note opens. A box's password covers every note inside it.
- Scheduled notes stay hidden until the time you chose.
- Notes you mark to stay out of search are never offered to search engines.
Chats
Chats can be end-to-end encrypted. Each of your devices has its own key, made in your browser; the key that opens a chat is wrapped for each device of the two people in it, so the server only ever stores scrambled text it cannot read. Clearing your browser's storage on a device removes its key; another of your devices can share it again.
The site
- Every page is served over HTTPS.
- Uploaded pictures are checked, resized and re-encoded before they are stored.
- Text people write is cleaned before it is shown, so it cannot run code in your browser.
- Administrators cannot read end-to-end encrypted chats.
Reporting a problem
Found a security issue? Please tell the site's administrators privately before sharing it anywhere, with enough detail to reproduce it. Do not access other people's accounts or data while testing. We will look into every report and fix confirmed problems as quickly as we can.
If you think someone has accessed your account, change your password, turn on two-step verification and contact the administrators.