decayfmt Is Not a Self-Destructing File Format, but I Like the Idea

decayfmt is a small Rust experiment built around a wonderfully strange idea: files that become slightly more corrupted every time you read them.

Images use .idcy<x> and text uses .tdcy<x>, with the number controlling how aggressively the contents decay.

The examples are fun. A low instability value slowly turns text into increasingly strange nonsense over repeated reads. A high value can reduce an image to noise after only a few opens.

The implementation deliberately damages the file before displaying it. If you run:

decayfmt open note.tdcy8

the reader loads the file, corrupts part of its payload, writes that corruption back to disk and only then shows you the resulting contents.

That ordering is important because killing the viewer after seeing the file does not give you a free read.

But I think calling this a “file format that corrupts itself” gives the format a little too much credit.

The file doesn’t corrupt itself.

The reader corrupts the file.

Open the same file with a hex editor, write another decoder, copy it somewhere else first or modify the decayfmt program and nothing forces the corruption to happen.

The project itself acknowledges this, calling decayfmt a social contract rather than cryptography. A backup defeats it completely.

I think that distinction actually makes the project more interesting rather than less.

It raises the question of what a genuinely ephemeral file would require.

In theory you could build something around this idea where information was intended to be readable only once. The first successful read could destroy the only available decryption key, making subsequent attempts useless.

But that requires considerably more than a file format.

You would need some trusted component controlling access to the key, whether that was a remote service, secure hardware or some other cryptographic mechanism. And even then, once plaintext reaches somebody’s screen, there is no technical way to stop them from photographing it, recording it or otherwise copying what they can see.

So “read once” can really only mean:

the system will only give you the original data once.

It cannot mean:

the information can only ever be observed once.

That is a much harder problem.

What decayfmt does demonstrate nicely is a different concept: making degradation part of the experience of interacting with data.

We normally design file formats around perfect reproducibility. Reading a JPEG ten thousand times should not alter the JPEG.

decayfmt intentionally violates that assumption.

The act of observation changes the artifact.

I like that idea.

I just think the more accurate tagline would be something closer to:

A file reader that damages its files every time it reads them.

Or perhaps:

A social contract enforced by a pinky promise.

That is less magical than a self-destructing file.

It is also considerably more accurate.