This guide is in English for now. The tool itself works in your language.
Snapshot format and limits
This page explains how a statement, catalogue, receipt, card or staff view reaches another person's phone when there is no server. It is for anyone who wants to check the privacy claims.
One text token
Every snapshot is one piece of text, called an NS1 token:
NS1z.<body>.<checksum>- NS1 is the version. A future version will use a different number, and an old viewer will say it cannot read it.
- z means the data is compressed (deflate). e means compressed and then locked with a passcode. u means plain, used only on old browsers that cannot compress.
- body is the data written in URL-safe base64.
- checksum is a CRC-32 of the body, eight hex digits.
What is inside
JSON with a version number, the kind (statement, catalogue, receipt, feedback, loyalty card or staff view), the date it was made, an end date, the shop's name and the details you ticked (phone, UPI ID, GSTIN, address), and the data of that kind. Only what you tick is included.
Link or file
- Link:
https://view.niveshsahayak.in/#NS1z.... Everything after the#stays inside the browser: it is never sent to our server, to GitHub or to anyone else. - File: a small text file ending in
.nssharethat holds the same token. The customer opens it with "Open a file" on the viewer page, or pastes its contents.
Passcode
With a passcode the compressed data is encrypted with AES-GCM (256 bit). The key comes from the passcode with PBKDF2-SHA256 and 150,000 rounds, with a random salt and a random IV in every token. A wrong passcode is detected by the GCM tag. A short numeric passcode can be guessed by someone who tries all of them, so use a longer one for anything valuable, and give it to the person by a different route than the link. Staff salary links always need a passcode.
End date
The end date is inside the data and is checked against the phone's own clock. It stops an old dues page from being paid by mistake. It is not security: a person with the link can still read the data with technical tools. Only a passcode stops that.
Checksum
The checksum catches a link that a chat app cut short or a typing slip. It is not a signature: anyone can make a valid token with any content. That is why the customer page asks them to confirm the amount and the payee name with the shop, and shows the UPI ID before they pay.
Size
| Link length | What to do |
|---|---|
| Up to about 1,800 characters | Safe to send in a chat message. |
| 1,800 to 6,000 | Some apps may shorten it. Send the file too. |
| Over 6,000 | Send only the file. |
| Up to about 900 | A QR code is made. Longer links cannot be scanned reliably. |
These numbers are chosen to be on the safe side. They were checked on made-up data (30 catalogue items fit a chat link), not on every chat app.
What nothing here can do
- It cannot update by itself, because nothing is stored on a server.
- It cannot tell you that the customer opened it or paid.
- It cannot take back a link after you have sent it.