Send a secret that deletes itself
Paste a password, an API key, anything you shouldn't be sending over chat. You get a link that works exactly once — then it's gone for good.
Create a secret
Three steps, and the key never leaves your device
Locked here, not there
Your browser generates a random key and encrypts the secret with it before any network request happens.
We store the locked box
Only the encrypted result is sent. We store it against a random ID with a 24-hour timer.
Opened once, then destroyed
The reader's browser fetches the box and unlocks it locally. Our copy is deleted in the same instant.
Everything after the # is called the URL fragment. Browsers have never sent it
with a request — it's how #section links have always worked. That's not a promise
we're making; it's a property of the web we're relying on.
Exactly what we can and cannot see
What our server never receives
- × Your secret, in readable form
- × The decryption key
- × Your name, email, or an account
- × Cookies, or anything that identifies you
What our server does store
- • An encrypted blob it cannot open
- • Two random IDs
- • A 24-hour expiry timer
- • Two running totals: secrets created, secrets read
Those totals are two plain numbers with nothing attached — no time, no place, no person. They are the only thing here that outlives 24 hours.
What this version does and doesn't do
What's being built next
Split-channel delivery
Send the link one way and a short code another — over the phone, say. Without the code the secret is mathematically unopenable, not merely "we refused".
Read notifications
Optional email the moment your secret is opened, or when it expires unread. Still no account — the address dies with the secret.
Choose your own expiry
5 minutes to 24 hours, picked when you create the link.
Small file support
Send a .pdf, .png, .zip or .txt the same
way — encrypted in the browser, opened once.
Before you paste something important
What if I lose the link?
Then the secret is gone. There's no account to log into and no lookup we can run — the link is the only reference that exists, and the key inside it is the only copy of the key.
This is the trade for not being able to read your data ourselves. If we could recover it for you, we could also read it without you.
Will Slack or Outlook destroy the secret by previewing the link?
No. Opening the link just shows a page with a button on it — nothing is destroyed until somebody actually clicks Reveal.
That's deliberate. Chat apps and corporate mail scanners fetch every link they see to build previews. A service that destroyed the secret on page load would have it eaten by a robot before the human ever clicked.
Why is the key in the link instead of on your server?
Because a key on our server is a key we can use. Putting it after the # means
your browser keeps it locally and never transmits it — so the encrypted blob we store is
genuinely useless to us.
It also means anyone who gets the whole link gets the secret. Treat the link like the password itself.
What happens if someone opens it before the intended person?
They get the secret, and the real recipient gets "already read". That's the alarm: if your colleague says the link didn't work, assume it was intercepted and rotate the credential.
Not knowing is the failure mode of email. Knowing is the point of this.
Is this actually secure, or is that just marketing?
The encryption is AES-256-GCM, done by your browser's built-in crypto — the same primitive banks and password managers use. The keys come from a cryptographic random source, never a predictable one.
What that buys you, precisely: a stolen database, a compromised server, a backup leak, or a legal demand all get unreadable bytes. What it does not buy you is protection from us deliberately publishing bad JavaScript. See the caveat above — we'd rather say it than hide it.
Who made this and why should I believe any of it?
It's an open-source project built in the open, with the design decisions and their trade-offs written down. You don't have to take any of this on faith — the whole thing is a few hundred lines you can read yourself, including the part running in your browser right now.