How it works

1. You write a note. Your browser scrambles (encrypts) it with a brand-new random key before anything leaves your device.
2. We store only the scrambled version. To us it looks like random gibberish. We never receive the key.
3. The key rides in the link, after the #. Browsers never send the part of a link after "#" to a website's server. So the person with the link has the key, and we don't.
4. The reader taps "Reveal". Only then do we hand over the scrambled note and delete it from our database in the same instant. Their browser unscrambles it on their screen.
5. It burns. The note is already gone from our servers. The countdown and fire are the fun part.

Why there's a "Reveal" button

Apps like iMessage, Slack, WhatsApp and many email systems open links automatically to build previews or check for viruses. If opening the link burned the note, a robot would "read" it before your friend did. So opening the link is safe. The note only burns when a human taps Reveal.

Truly one-time

Handing over a note and deleting it happen as a single database operation. If two people somehow tap Reveal at the same moment, exactly one of them gets it. The other sees "this message doesn't exist."

Passwords (optional)

Add a password and it gets mixed into the encryption key, so the link alone isn't enough. Send the password a different way than the link. After 5 wrong guesses, the note destroys itself.

Your private status link

When you create a note you also get a status link, just for you. It tells you whether the note has been read, and lets you destroy it early. It never shows the message, and no account is needed.

Honest limits

• The link is the key. Whoever opens it first reads it. Send it to one person, through a channel you trust. Whatever app you send it with (text, email, WhatsApp…) carries the key, so it's only as private as that app.
• Our host sees normal web traffic. Like every website, our host (Cloudflare) sees visitors' IP addresses and when requests happen. It never sees the part of the link after the "#", so it can't read notes either.
• Screens can be captured. The reader can always take a screenshot or a photo. Self-destructing doesn't stop that.
• You're trusting this website's code to do the encryption properly, the same as with any web-based tool. The code runs in your browser and anyone can inspect it.
• Unread notes don't last forever. They're destroyed after the expiry you chose (30 days at most).