Secret note
Send a note that reads once.
For passwords, API keys and private messages. Your note is encrypted in this browser
before it's sent; the key lives in the link's # fragment, which never
reaches our server. We only ever hold scrambled text.
0 / 10,000
Your secret note is ready
The key follows the #. Anyone with the full link can read the note, so treat it like the secret itself.
The link alone won't open it: send the passphrase another way (a call, a different app).
How it works
- Encrypted before it leaves. Your browser encrypts the note with AES-256-GCM using a fresh random key. The key goes in the link after the
#, which browsers never send to a server. - Read once, then gone. By default the note is wiped from our server the moment it's opened. Opening the link again says it has already been read.
- Safe from link previews. The recipient presses Reveal note first, so a chat app's link preview can't use up a one-time note.
- Optional passphrase. With one, the key is also derived from the passphrase (PBKDF2-SHA256, 600,000 rounds), so someone who gets hold of the link still can't read it. A wrong passphrase reveals nothing and doesn't use up the note; after 10 wrong tries it's locked for good.
- Always expires. Unread notes are deleted after 1 hour, 1 day or 7 days, whichever you choose.
Need to send a file instead? Use Encrypted Share.