tiny notesShare it once.Then it's gone.
Your note is encrypted in your browser before it is sent. We store only locked text we cannot read, and delete even that once it has been opened or time runs out.
How it works
The note and its key take different routes. Only the two ends ever hold both.
Your browser
Locks the note
Makes a random 256-bit key and encrypts your note with AES-256-GCM before anything is sent.
Our server
Stores what it cannot read
Keeps the locked text, a view count and an expiry time. Deletes it after the last view or when time runs out, whichever comes first.
Their browser
Unlocks the note
Fetches the locked text and opens it with the key from the link, on their device.
The key travels inside the link you send, after the #. Browsers never send that part, so it goes from your browser to theirs without touching our server.
Who can read your note?
Can read it
What they have
- The complete link
- The key, in the part after the #
Why
Their browser fetches the locked note and unlocks it with the key from the link, on their device. Anyone holding the complete link counts as a recipient, so send it through a channel you trust.
Cannot read it
What they have
- The locked text
- A view count and an expiry time
Why
The key is never part of any request. It lives after the # in the link, and browsers do not send that part. The server cannot decrypt what it stores, and cannot log a key it never receives.
Cannot read it
What they have
- A copy of the locked text
- Nothing else of use
Why
Keys are not stored anywhere on our side, so a leaked database or backup holds only locked notes. Opening one without its key means breaking AES-256, which is not practical.
Cannot read it
What they have
- Locked text passing by
- Never the key
Why
The note is already locked before it leaves your browser, and the key is not sent with it. Intercepting the traffic yields the same noise our server holds.
Good to know
Opening a link is free
The link shows how many views are left and when the note expires. Only pressing Reveal uses a view.
One view means one reader
If two people press Reveal on a one-view note at the same moment, exactly one of them gets it.
Gone is gone
A viewed or expired note cannot be recovered by anyone. A used, expired or mistyped link all look the same.
Lose the link, lose the note
The key exists only in your link. We cannot look a note up for you or reset anything, because we never had the key.
Limits
Plain text up to 75 KB, 1 to 100 views, and a lifetime from 1 minute to 7 days.
Share the link privately
Anyone who has the complete link can open the note. Send it through a channel you trust, and prefer one view when a single person needs it.