A note that opens a single time, then destroys itself. We never hold the key — so we can't read it, and neither can anyone after you.
Free notes are fixed at 1 read · 24 hours.
Real-time, end-to-end encrypted chat that exists only as long as you need it.
Messages are encrypted client-side with the same architecture as Cindernote's notes. The key lives only in your shared link, never on our servers.
Send images (automatically compressed for speed) and files up to your plan's limit, encrypted before they ever leave your device.
Sessions expire automatically, whether by time limit or inactivity. Free sessions can't be extended or reopened once they're gone.
Start a conversation with a link. No sign-up, no phone number, no metadata tying it to your identity.
Like any link-based tool, anyone with the link can read the conversation — and screenshots exist outside of encryption's reach. We're upfront about that so you know exactly what you're trusting us with.
Type a note or drop a file. It's encrypted in your browser before anything leaves your device — the key is generated locally and stays there.
You get one link with the key tucked into the part of the URL your browser never sends us. Pass it along however you like.
The moment it's read — or when the timer runs out — the note is wiped from memory. No copy, no backup, no trace on our side.
Most tools hide the delete behind a spinner. We made it the moment worth remembering — a secret that visibly disappears is one you actually trust is gone. Try it →
The design makes it impossible for us to see your note — even if we were compromised, subpoenaed, or curious.
Encryption happens in your browser. The decryption key lives in the URL fragment after the "#", which browsers are built to never transmit to a server.
What lands on our server is an unreadable blob. Under a breach, a subpoena, or a rogue admin, there's nothing meaningful to hand over.
Encrypted data is stored using a managed, durable storage layer — meaning even the underlying infrastructure provider only ever holds encrypted ciphertext, never the decryption key. The key exists only in the URL fragment shared between sender and recipient, and is never transmitted to or stored by our servers. Whether that ciphertext sits in memory or on disk makes no practical difference: without the key, both are equally unreadable.
Every line is open source with reproducible, signed builds — so you can verify the code you're running is the code we published.
Every read is checked, decremented, and deleted in a single atomic operation at the storage layer — not a check-then-act sequence. This holds even when multiple server instances are running concurrently, so a note can never be viewed more times than its limit allows, regardless of server load or scaling.
Where notes are protected by an optional passphrase, verification uses constant-time comparison — so an attacker measuring response times can't learn anything about how close a guess was to correct.
Note consumption only ever happens through direct user interaction in a real browser session — never during server-side rendering or automated page crawling. Link-preview bots and email security scanners can't accidentally burn a note before its intended reader opens it.
Expiry isn't just a flag we check later — it's enforced natively at the storage layer, so an expired note is genuinely gone from our systems, not just hidden from view.