Burn Note

How Burn Note Works

Burn Note is built so that the server never has what it needs to read your note. This page explains the design in detail.

How it works in 3 steps

  1. 1.Write and create

    Encrypted in your browser. The key is kept in the link, not on our server.

  2. 2.Send the link to one person

    Use any app. Opening the link alone does not reveal or delete the note.

  3. 3.They click Open Note

    The note is shown once and deleted from the server right away.

Before you paste a secret

  • No account and no recovery: if the note is lost, it is gone.
  • Unread notes expire automatically, from read-once (7 days) up to 30 days.
  • A destroyed page means the note was opened or expired — Burn Note cannot tell which.

See it for yourself — create a note below.

0 / 65,536
Expiration

Destroyed immediately after reading

Password Protection

Clicking the button generates a URL containing the encryption key. No plaintext or keys are ever stored on the server.

1. Encryption in the browser

When you create a note, your browser generates a random 256-bit key and encrypts the text with AES-256-GCM using the Web Crypto API. Only the ciphertext and IV are sent to the server.

2. The key lives in the URL fragment

The key is appended to the link after the # sign. The fragment is handled by the browser and is not included in HTTP requests, so it never reaches the server or its logs.

3. Optional password protection

If you set a password, the note key itself is encrypted with a key derived from the password using PBKDF2 with 600,000 iterations. The recipient needs both the link and the password.

4. Delete on read

When the recipient opens the note, the server returns the ciphertext and deletes it. A second visit finds nothing. Unread notes expire automatically at the end of the chosen period.

FAQ

What does the server know?
The server stores an ID, the ciphertext and IV, whether a password is set, and timestamps. It never receives the key or the plaintext.
What are the limits of this design?
Anyone holding the full link can open the note, so send it only to the intended recipient. Deletion happens right after the note is returned rather than as a single atomic step, so two nearly simultaneous opens could both succeed. The recipient can still copy or photograph the content after reading it.

Back to Burn Note — free self-destructing encrypted notes.