We use a 'zero-knowledge' approach. Meaning that your unencrypted Wispr and your passphrase never leave your browser. Our servers only receive your encrypted Wispr.

We leverage a combination of an EFF diceware wordlist and modern Crypto libraries to generate strong random passphrases. By leveraging the large wordlist and selecting 6 random words we are able to generate a high level of entropy (ie. it would take many years to brute force.)

Encryption and decryption are done on the client side in the browser using the Crypto library with up to date modern and strong algorithms.

We use the EFF diceware wordlist which contains 7776 unique uncommon words and leverage the Crypto library to select six words randomly from that list. In short, yes it can be brute forced, however there are a total of 221+ quadrillion possible combinations. To make it even harder we combine the passphrase with a unique ID for each Wispr, adding in the 72 hour expiration of each Wispr, it becomes nearly impossible for a bad actor to brute force.

No, the passphrase generation, and data encryption are performed in the browser. This means that your passphrase and unencrypted Wispr are never submitted to the wisprgram servers.

Since all of the encryption is handled in the browser Wisprgram doesn't have any way to recover your passphrase. So in the case that you lost it your only option is to create a new Wispr.

We have decided that as part of our launch we are going to make it free for anyone with unlimited Wisprs. This may change in the future though.