GhostDrop is a decentralized Dead Man Switch built on the Aptos blockchain with Shelby Protocol for encrypted blob storage. It enables users to encrypt sensitive data locally and store it verifiably on the Shelby network. If the user becomes inactive for a configured period of time, the encrypted data is automatically released to designated recipients via email.
Your heartbeat keeps it secure. Your silence releases it.
| Feature | Description |
|---|---|
| Zero-Knowledge Encryption | Files are encrypted locally using AES-256-GCM before upload. Keys never leave your device. |
| Decentralized Storage | Encrypted blobs are stored on the Shelby network — verifiable, immutable, and always available. |
| Dead Man Switch | Configurable inactivity timer triggers automatic data release to recipients. |
| Wallet Authentication | Secure login via Aptos-compatible wallets (Petra). |
| Email Notifications | Recipients are notified via email with decryption access when the switch triggers. |
| Check-In Mechanism | Reset your timer by checking in from your wallet — proving you're still active. |
| Vault Management | Create, monitor, extend, and delete vaults from a unified dashboard. |
- Frontend: React 19, Vite, Tailwind CSS, Framer Motion
- Blockchain: Aptos Testnet (via
@aptos-labs/ts-sdk) - Storage: Shelby Protocol Testnet (
@shelby-protocol/sdk) - Encryption: Web Crypto API (AES-256-GCM)
- Backend: Express.js with node-cron watchdog
- Notifications: Nodemailer (Gmail), Resend, EmailJS
- Wallet: Petra Wallet Adapter
┌─────────────────────────────────────────────────────────┐
│ Client (Browser) │
│ ┌──────────┐ ┌──────────────┐ ┌───────────────────┐ │
│ │ Encrypt │→ │ Upload Blob │→ │ Register on Aptos │ │
│ │ (Local) │ │ (Shelby SDK) │ │ (Wallet Sign) │ │
│ └──────────┘ └──────────────┘ └───────────────────┘ │
└─────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Server (Express.js) │
│ ┌──────────────┐ ┌────────────────┐ ┌─────────────┐ │
│ │ Watchdog Cron│→ │ Check Timers │→ │ Send Email │ │
│ │ (Every Min) │ │ (Shelby Fetch) │ │ (Nodemailer)│ │
│ └──────────────┘ └────────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────┘
# Clone the repository
git clone https://github.com/Yachtmask/Ghostdrop.git
cd Ghostdrop
# Install dependencies
npm installCreate a .env.local file in the project root:
# Required: Shelby Protocol API Key (get from https://geomi.dev)
NEXT_PUBLIC_SHELBY_API_KEY=your_shelby_api_key_here
# Optional: Email notification providers
GMAIL_USER=your_gmail@gmail.com
GMAIL_APP_PASSWORD=your_app_password
RESEND_API_KEY=your_resend_key
# Optional: Telegram notifications
TELEGRAM_BOT_TOKEN=your_bot_token
# Optional: App URL for download links
APP_URL=http://localhost:3000# Development mode (with hot reload)
npm run dev
# Production build
npm run build
npm run previewThe app will be available at http://localhost:3000.
- Push your code to GitHub.
- Import the repository in Vercel.
- Add the environment variable
NEXT_PUBLIC_SHELBY_API_KEYin Settings → Environment Variables:- Key:
NEXT_PUBLIC_SHELBY_API_KEY - Value: Your API key from Geomi
- Key:
- Deploy.
Note: The backend watchdog server (
server.ts) requires a persistent Node.js runtime and cannot run on Vercel's serverless platform. For production use, deploy the server separately on a VPS or use a service like Railway/Render.
- Connect Wallet — Authenticate with your Aptos wallet.
- Create a Vault — Upload a file, set a timer duration, add recipient emails, and provide a passphrase.
- Encryption — The file is encrypted locally with AES-256-GCM. The key is derived and packaged for each recipient.
- Upload — The encrypted blob and metadata are uploaded to the Shelby network and registered on Aptos.
- Watchdog — A background cron job monitors vault timers. If your check-in expires, recipients are notified.
- Check-In — Visit your dashboard and check in to reset the timer and prove activity.
- Release — If the timer expires, recipients receive an email with a download link and decryption passphrase.
https://ghostdrop-nine.vercel.app
- All encryption happens client-side — keys never leave the browser.
- Passphrases are stored server-side only for auto-release functionality.
- The watchdog server should be deployed in a secure, trusted environment.
- Always use app-specific passwords for Gmail integration.
- API keys should be stored as environment variables, never hardcoded.
Contributions are welcome. Please open an issue first to discuss proposed changes.
This project is licensed under the MIT License. See LICENSE for details.
GhostDrop — Secure your legacy. Built for those who think ahead.