Every ship.page drop lives on an unguessable subdomain, and anyone holding the link can view it. That sentence makes some security teams twitch — so let's do the actual arithmetic on what "unguessable" means, and be honest about where it stops.
Updated September 2026: slug tails went from 8 characters to 5 — the math below reflects the current format — and password protection has since shipped on the paid plans.
The claim
Slugs look like vast-juice-c2dse: two words drawn from curated lists, plus a 5-character base36 tail minted from a CSPRNG. There's no public index, no directory page, and no sequential IDs to walk. Possession of the URL is the credential.
Doing the math
- The word pair: 939 × 2,108 ≈ 2 million combinations — about 21 bits
- The tail: 365 ≈ 6 × 10⁷ — about 26 bits
- Together: ~47 bits, roughly 1.2 × 10¹⁴ possible slugs
Suppose someone targets one specific drop and fires a million guesses per second — every one a full HTTPS request. The expected time to a hit is around four years, and that's before rate limiting turns the spray into a trickle. Spraying for any drop doesn't help much either: even with a million live drops, the expected effort per hit sits around 10⁸ requests — hundreds of millions of full HTTPS requests for a single page. And each guess buys exactly one page, not a foothold — there's nothing to enumerate from a found drop.
What 47 bits buys you
- Unlisted, not public. Crawlers only find what's linked somewhere, and we never list drops anywhere. But a link is a bearer token: everyone you send it to can send it onward, and that's a people problem, not a math problem.
- Origin isolation. User content serves exclusively on
*.shipped.run, each drop on its own subdomain — never on the origin that holds your session. - A shrinking window. Anonymous drops expire after 30 days, then stay offline but privately claimable for another 30 before deletion.
Where it stops
A link is a bearer token. It forwards, it screenshots, it lands in browser histories and Slack search indexes. For review artifacts that's fine — the blast radius of a leak is a coverage report. For regulated data, it's not. If a leaked URL would be an incident, put the page behind your SSO and use a different tool. We'd rather be clear about that boundary than blur it.
Password-protected drops cover the cases in between — they're live on the paid plans, and the password guide has the setup. The link stays the boundary; the password thins who's allowed through it. For regulated data the advice above stands. Either way the rule of thumb is the same: ship what you'd paste in a company-wide channel, and nothing you wouldn't. For the story of why the whole product works this way, start with the launch post.