Burn Notes: How to Share a Secret That Deletes Itself

You need to send a Wi-Fi password, a one-time code, an address — and you'd rather it didn't live in chat history forever. The Self-Destructing Encrypted Note encrypts the message locally and hands you a link that decrypts exactly once, then refuses.

The trick: the URL fragment

The link carries two parts. The ciphertext sits in the query string. The decryption key sits in the fragment — the #k=… part — and browsers never transmit fragments in HTTP requests. Whatever server hosts or forwards the link sees only unreadable ciphertext; the key travels exclusively inside the link you share.

Opening the link wipes the fragment from the address bar immediately (after stashing it in the tab's memory for the reveal), and a browser flag blocks a second decryption. An optional password entangles its own derived key material into the fragment key: without both, the math doesn't open.

What "burn" honestly means

The burn is best-effort client-side enforcement, and the tool says so up front:

• Within the reader's browser, the note won't decrypt twice.
• Anyone who copied the full link before opening holds the key too — treat the link itself as the secret.
• A server can't delete what it never stored, but it also can't stop link forwarding.

The right mental model: one-time delivery with a tamper-resistant envelope, not DRM.

When to use what

• Burn note: short, one-shot secrets — codes, credentials with immediate expiry, one-time instructions.
• Password + burn note: adds a second factor for higher-stakes messages.
• File Encryptor: full documents that need to persist encrypted.
• Password Generator: making the passwords you're about to share this way.

Generate strong ones with the Password Generator; for files, see the Client-Side File Encryptor.