Every ship.page drop lives on an unguessable subdomain, and anyone holding the link can view it. That sentence makes some security teams twitch — so let's do the actual arithmetic on what "unguessable" means, and be honest about where it stops.
Updated August 2026: slug tails went from 8 characters to 5 — the math below reflects the current format.
The claim
Slugs look like vast-juice-c2dse: two words drawn from curated lists, plus a 5-character base36 tail minted from a CSPRNG. There's no public index, no directory page, and no sequential IDs to walk. Possession of the URL is the credential.
Doing the math
- The word pair: 939 × 2,108 ≈ 2 million combinations — about 21 bits
- The tail: 365 ≈ 6 × 10⁷ — about 26 bits
- Together: ~47 bits, roughly 1.2 × 10¹⁴ possible slugs
Suppose someone targets one specific drop and fires a million guesses per second — every one a full HTTPS request. The expected time to a hit is around four years, and that's before rate limiting turns the spray into a trickle. Spraying for any drop doesn't help much either: even with a million live drops, the expected effort per hit sits around 10⁸ requests — hundreds of millions of full HTTPS requests for a single page. And each guess buys exactly one page, not a foothold — there's nothing to enumerate from a found drop.
What 47 bits buys you
- Unlisted, not public. Crawlers only find what's linked somewhere — we never list drops anywhere, so the only people who can find yours are the ones you gave it to.
- Origin isolation. User content serves exclusively on
*.shipped.page, each drop on its own subdomain — never on the origin that holds your session. - A shrinking window. Free drops expire after 7 days, so a link that leaks usually points at a 410 within the week.
Where it stops
A link is a bearer token. It forwards, it screenshots, it lands in browser histories and Slack search indexes. For review artifacts that's fine — the blast radius of a leak is a coverage report. For regulated data, it's not. If a leaked URL would be an incident, put the page behind your SSO and use a different tool. We'd rather be clear about that boundary than blur it.
Password-protected drops are on the roadmap for the cases in between. Until then, the rule of thumb is simple: ship what you'd paste in a company-wide channel, and nothing you wouldn't. For the story of why the whole product works this way, start with the launch post.