Self-Destructing Note
Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.
Passwords sent over chat stay in the chat history, on both devices and on the service’s servers, indefinitely. A one-time link moves the secret out of that history: the note is encrypted in your browser, the key travels in the URL fragment, and the copy on the server is destroyed the moment it is read.
The note is encrypted with AES-256-GCM in this tab. The key lives only after the # in the link, and a browser never sends what follows a # to a server (RFC 3986 §3.5). What the server receives is ciphertext it cannot open.
The ciphertext is held in the server’s memory only. It is erased when the time runs out or the note is read once, and a server restart forgets every note made before it.
Up to 64 KB.
How to use it
Write the note
It is encrypted in the tab before anything is sent. The server receives ciphertext and stores it in memory under an opaque id.
Copy the whole link, fragment included
The part after the `#` is the decryption key and browsers never send it to a server. A link truncated at the `#` opens a note nobody can read.
Send the link and tell the recipient it is single-use
The first open destroys the note. A chat client that fetches link previews can count as that first open, so a note that arrives already dead is usually the preview bot, not the recipient.
Common questions
Can the server read the note?
No. It holds ciphertext and never sees the key, which stays in the fragment. That is a structural property, not a policy — there is nothing on the server to decrypt with.
The link says the note is gone and it was never opened.
Two causes. A link preview fetched it first — send it in a way that does not unfurl. Or the server restarted: notes live in memory only, so a deploy forgets everything unread.
Can I make it last longer, or be read twice?
No, deliberately. A note that survives reading is a note sitting on a server waiting to be found, and the expiry is what keeps the window small.
Should I use this for a file?
It takes text only. For a file, encrypt it with the file tool and send the passphrase through a note like this one.
Feed it from
Text Encrypt & Decrypt
Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Disposable Email
Gives you a throwaway inbox that receives mail for a limited time, with attachments viewable in place.
Next
These accept what this tool produces, so the result can go straight in.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Disposable Email
Gives you a throwaway inbox that receives mail for a limited time, with attachments viewable in place.
Text Encrypt & Decrypt
Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.