*Source: <https://send.sgit.ai/storyboards/say-it-aloud/> · send.sgit.ai v0.1.4 · generated from the same data as the page, so the two cannot drift.*

# A token you can say aloud

> river-cloud-3847 is the whole key: Maya says it on a call, Hugo types it, Eve hears it a week too late. 8 panels.

*Send, as storyboards · For everyone · board 02 · built · send.build, 20 October 2026. The script of a storyboard drawn by the kit at api.storyboards.sgit.ai; the data is storyboard.json and bundle.json beside this file.*

- [Send with a friendly token](/)

## 1. A token you can say aloud (cover)
*Two words and four digits. Then let it expire.*
- Maya, wave, happy
- Hugo, stand, happy
- Eve, shrug, thinking

Note: The friendly token: one short string that is the whole credential for one transfer.
Source: learn/qr-codes/index.md

## 2. On the phone
- **Maya** (point, happy): "It's three words, Hugo. river, cloud, three eight four seven."
- Hugo, stand, thinking
- prop: phone

Note: The moment a friendly token is for: two people, one call, no screen to scan.
Source: learn/qr-codes/index.md

## 3. Two words and four digits
- Maya, think, thinking
- prop: board, river-cloud-3847 /  / 320 words x 320 words x 10,000 / = 1,024,000,000 tokens

Note: The word list is send.sgraph.ai's own, so a token made on either site opens on the other.
Source: learn/qr-codes/index.md

## 4. Both sides derive the same two things
- **The Server** (stand, calm): "I never see the token."
- prop: board, token  ->  SHA-256  ->  transfer id /  / token  ->  PBKDF2, 600,000 rounds /           ->  the key

Note: The transfer id and the key both come from the token, in both browsers; the server maps nothing.
Source: learn/qr-codes/index.md

## 5. Hugo types it
- **Hugo** (point, determined): "river… cloud… three eight four seven."
- prop: phone
- prop: mark, opens

Note: The open page accepts a token typed in, or the link that carries it.
Source: open/index.html

## 6. Eve was listening
- **Eve** (shrug, thinking): "I heard it. A week later."
- prop: calendar, expired
- prop: mark, 410: gone

Note: A token can be guessed offline by anyone holding the ciphertext, so it suits a link that expires. This one did.
Source: learn/security/index.md

## 7. What a friendly token is for (evidence)
> a friendly token is for a link that expires, a file that is not worth that effort, and a moment when speaking it is the point; a random key is for everything else.
> (learn/qr-codes/index.md)
- Maya, point, happy

Note: Quoted from the QR codes page, word for word.
Source: learn/qr-codes/index.md

## 8. Say it, type it, scan it. Then let it expire. (punchline)
**Say it, type it, scan it. Then let it expire.**
- Maya, wave, happy
- Hugo, arms-up, happy
- Eve, shrug, worried

Note: The trade, stated on the send page where the choice is made.
Source: index.html