Zero-knowledge by design
Your secret is encrypted locally before upload. The server stores ciphertext only and cannot decrypt it.
Burn-after-reading links
Once a secret is opened, it is permanently deleted. Shared links are single-use to reduce accidental exposure.
Optional password protection
Add a password for a second factor. The recipient needs both the link and your password to decrypt. Wrong password attempts won't destroy the secret.
Simple and auditable
No accounts, no analytics or advertising trackers. Just focused functionality for secure sharing.
How it works
You create a secret, your browser encrypts it, and only encrypted data is sent to the server. The decryption key is kept in the URL fragment so it is never sent in HTTP requests.
Recipients open the link, decrypt in their own browser, and the stored ciphertext is deleted after retrieval or expiry.
When you add a password, a one-way verification code is stored on the server (not the password itself). This lets us confirm the correct password before releasing the secret, so a wrong guess won't accidentally destroy your message.
Privacy & Terms
We do not use cookies, analytics trackers, or advertising scripts. Like most websites, limited infrastructure logs may include basic connection details for reliability and abuse prevention. Read the full privacy and terms page.