Send a Secret
Share a password or private message with a link that self-destructs after one read. It is encrypted on your device before it leaves, and the key never touches the server.
🔒 Zero-knowledge — we only ever store ciphertextSomeone sent you a secret
Reveal it when you are ready. If this secret is set to self-destruct, opening it will permanently delete it from the server, so make sure you can read it now.
How it works
Encrypted on your device
Your note is encrypted in the browser with AES-256-GCM using the Web Crypto API before anything is sent. The plaintext never leaves your machine.
The key rides in the link
A fresh random key is generated and placed after the # in the link. Browsers never send the part after the # to a server, so the key stays between you and the recipient.
It burns on read
The first time the link is opened, the encrypted record is fetched and deleted in the same database call. After that the link is dead.
Why this is genuinely private
Most "secure" sharing tools still send your data to a server that could read it. This one cannot. The only thing stored is ciphertext, and the key that unlocks it lives in the URL fragment, which by web standard is never transmitted in an HTTP request. So even a full database dump would reveal nothing without the links, and the links only you and your recipient hold. This is what "zero-knowledge" means: the service has no knowledge of your secret.
For an extra layer, add a passphrase. The note is then locked twice, once with the key in the link and once with a key derived from your passphrase using PBKDF2 with 210,000 iterations. Even someone who intercepts the link cannot open it without the passphrase, which you share separately.
What it is good for
Sending a password to a teammate without leaving it in chat history, handing off an API key or recovery code, sharing a private address or a one-off note. Anything you would not want sitting forever in Slack, email, or a notes app. The link does the job once, then it is gone.
Can the server read my secret?
No. Encryption happens in your browser and only the ciphertext is stored. The decryption key is in the part of the link after the # symbol, which browsers never send to any server. Without that key the stored data is meaningless.
What happens when the recipient opens the link?
If the secret is set to self-destruct, the encrypted record is read and deleted from the database in a single atomic call, then decrypted locally in their browser. Opening it a second time shows nothing because the record is already gone.
Will a link preview or a bot burn my secret early?
No. Nothing is read or deleted until the recipient clicks "Reveal secret." Chat apps that fetch a preview only load the page, which does not touch the stored record.
What if I lose the link?
It is gone. The key only exists inside the link, and the service never receives or stores it, so there is no recovery and no reset. That is the trade-off that makes it truly private.
Is there a size limit?
Secrets are meant to be short, like a password, a key, or a note, so there is a generous size cap. For large files use a dedicated encrypted file service.
Is it free?
Yes, completely free with no sign-up.
I build tools like this every day.
Senior full-stack engineer, available for senior or contract work, fully remote. See the rest of the lab or get in touch.