Why not just send it by email or chat?
Email, Slack, Teams and SMS keep messages forever: in sent folders, backups, search indexes and on every device that synced them. If any of those accounts is breached later, the password is still sitting there. A one-time link leaves nothing behind. Once opened, the message is gone from our server, and the link in the chat history points to nothing.
How the encryption works
- Your browser creates a random 256-bit key and encrypts the message with AES-256-GCM using the Web Crypto API.
- Only the encrypted data is uploaded. The key is put in the part of the link after the
#, which browsers never send to any server. - When the recipient clicks Reveal, the encrypted data is downloaded and deleted from the server in the same step, then decrypted in their browser.
- With a passphrase, the key is also mixed with a PBKDF2 key (310,000 rounds). The server only stores a hash that lets it refuse wrong passphrases, and deletes the secret after 5 wrong tries.
Link previews in chat apps cannot burn the secret: nothing is revealed until a person clicks the button.
Good habits for sharing secrets
- Send the passphrase through a different channel than the link, for example the link by email and the passphrase by phone.
- Pick the shortest expiry that works. One hour is enough if the person is waiting for it.
- If the recipient says the link was already used, assume someone else opened it and change the password.
- For a team that shares many passwords, a password manager with shared vaults is the long term answer.
Frequently asked questions
Can you read my secret?
No. It is encrypted in your browser before upload and the key stays in the link fragment, which is never sent to our server. We only ever hold unreadable ciphertext.
What happens after the secret is viewed?
The encrypted data is deleted from the server in the same request that delivers it. Opening the link again shows that the secret is gone.
What if nobody opens the link?
It is deleted automatically when it expires, after 1 hour, 1 day or 7 days as you chose.
Will Slack, Teams or WhatsApp link previews destroy it?
No. Previews only load the page. The secret is fetched and deleted only when a person clicks 'Reveal the secret'.
How long can the message be?
Up to 20,000 characters, enough for passwords, API keys, recovery codes, SSH keys or a short note.
Can I delete a secret I already sent?
Yes. Right after creating it, click 'Burn it now'. The link stops working at once.