How to send personal data securely?

To send personal data securely, use a tool that encrypts the content before transmission and does not retain a permanent copy. SecretNote encrypts your message in the browser using AES-256, generates a one-time link, and permanently deletes the note after it is read. Set an expiration timer and enable burn-after-reading. This is significantly more secure than sending data through email or chat, which store message history indefinitely.

Is it safe to send API keys over email?

No. Email is not designed for secret delivery. Messages can be forwarded, indexed by email providers, stored in backups, and accessed by anyone with access to either inbox. API keys sent over email may remain accessible for years. Use SecretNote instead - credentials are encrypted in the browser, the server never sees the plaintext, and the note is permanently destroyed after the recipient opens it.

Should you share your password with anyone?

Ideally, never. If temporary access is unavoidable, rotate the password immediately after use and share it only through a self-destructing encrypted note. Using SecretNote means the password cannot be recovered from a chat log, email thread, or server log after the note is opened and deleted.

Can SecretNote messages be recovered after they are read?

No. When a note is opened, the server permanently deletes the ciphertext. The decryption key exists only in the URL fragment, which is never stored by SecretNote. There is no database backup, server log, or cached version that contains the plaintext. Even the SecretNote team cannot recover a note that has been read and deleted.

What should I avoid putting in normal chat apps?

Avoid passwords, API keys, SSH keys, private keys, recovery codes, identity numbers, and unredacted personal records in normal chat apps. These messages are stored on servers indefinitely and can be accessed if the account or server is compromised. Use SecretNote for this type of data so it does not remain in chat history.

Is SecretNote better than attachments for sensitive files?

For sensitive data, yes. Email attachments are often duplicated across inboxes, mail servers, and backups. The file may persist for years in locations neither sender nor recipient controls. Files shared through SecretNote are encrypted before upload, stored only as ciphertext, and permanently deleted after the recipient downloads them.

How long until a SecretNote is destroyed?

You can set the auto-destruction time for unviewed notes in Options before creating the link. The default is 3 days. Available options range from 1 hour to 30 days. Once a note is viewed with burn-after-reading enabled, it is destroyed immediately regardless of the expiration timer.

What is zero-knowledge encryption?

Zero-knowledge encryption means the service provider never has access to the content of the data they store. SecretNote stores only the encrypted ciphertext of your note. The decryption key is never transmitted to the server - it exists only in the URL fragment, which web browsers exclude from HTTP requests. SecretNote staff and server administrators cannot read the content of any note.

What is AES-256 and why does it matter?

AES-256 (Advanced Encryption Standard with a 256-bit key) is a symmetric encryption algorithm used by governments, banks, and security professionals worldwide to protect sensitive data. A 256-bit key provides 2 to the power of 256 possible combinations, making brute-force attacks computationally infeasible. SecretNote uses AES-256 to encrypt every note directly in the browser before anything is transmitted to the server.

How does the URL fragment keep the encryption key secret?

A URL fragment is the portion of a URL that comes after the # character. Web browsers do not include the URL fragment in HTTP requests sent to the server. When a recipient opens a SecretNote link, the server receives only the note ID - not the decryption key. The key is used entirely within the recipient's browser to decrypt the ciphertext locally. The server never learns the key at any point.

What is burn-after-reading?

Burn-after-reading means a note is permanently deleted from the server the moment it is opened and decrypted by the recipient. The link stops working immediately after first use. It ensures that even if the link is later intercepted, forwarded, or found in a message history, the data it pointed to is already gone and cannot be retrieved.

What is the difference between burn-after-reading and an expiration timer?

An expiration timer deletes a note after a set time period regardless of whether it has been opened. Burn-after-reading deletes the note the moment it is first opened. Both options can be combined: a note set to expire in 1 day with burn-after-reading enabled will be deleted after 1 day if unread, or immediately upon first read - whichever comes first.

Does SecretNote comply with GDPR?

Yes. SecretNote is operated by RapidFoundry LTD, a company based in the European Union, and the service is built with GDPR compliance in mind. Notes are stored as encrypted ciphertext only, with no personally identifiable information linked to the content. Because SecretNote uses zero-knowledge architecture, the service processes no personal data contained within the notes themselves.

Is SecretNote free to use?

Yes, SecretNote is completely free. No subscription, payment, or account registration is required to create or read notes. All core features - AES-256 encryption, self-destructing notes, file attachments, expiration timers, burn-after-reading, and password protection - are available without any cost.

Share private notes that self-destruct.

file image draft - not sent

0 B / 512 KB

or paste with Ctrl+V Attachment limits loading...

Links

delete after read 3 days tap to reveal

01 Duration if nobody opens it, ciphertext self-destructs after this window.

02 Destruct options when does the server forget it ever existed.

03 Directly open and decrypt decrypt automatically when the recipient opens the link, without clicking the confirmation button.

Send a self-destructing note in three steps

Everything happens in your browser. The server never holds a key.

01Type, paste, drop a file.

Your message is encrypted with AES-256 before anything touches the network.

the quiet thing you need to send…
→ aes256(•) → ciphertext

Screenshot: writing a private note in the SecretNote composer

02Send the link.

The URL carries the decryption key after the #, which browsers never send to a server.

https://secretnote.eu/en/a9f2#8f3d…7e1c

Screenshot: the generated secret link ready to share

03It disappears on read.

The server deletes the ciphertext the moment the link is opened. No backups, logs, or recovery.

ciphertext — a9f2
status: destroyed

Screenshot: the note is gone after being read

A private note, encrypted in your browser and gone after it's read.

Zero-knowledge architecture

AES-256 runs entirely in your browser. The key lives in the URL fragment after the #, which browsers never transmit. Our server only ever stores ciphertext it has no key for.

⇿

Self-destructing messages

When the link is opened, the ciphertext is fetched, decrypted locally, and immediately deleted. Open the same link twice and the second visitor finds nothing.

∅

Completely anonymous

Sending a note needs no account, no email, no personal information. Only the ciphertext, a random ID, and an expiry are stored — none tied to any identity. No tracking, no fingerprinting. A free account is optional and only unlocks a few extras.

How SecretNote protects your data

01Encryption in the browser

Your message is encrypted with AES-256 inside your browser tab. A random 256-bit key is generated locally — neither the plaintext nor the key is ever transmitted.

02Only ciphertext reaches us

The server stores a meaningless block of encrypted bytes under a random ID, and holds it only until it is read or expires.

03Key lives in the URL fragment

The key sits after the # in the link. Browsers never transmit the fragment to a server, so it stays strictly between sender and recipient.

04Deleted after first read

The recipient decrypts locally; the server destroys the ciphertext immediately. There is no recovery — not by us, not by them.

A person at their computer sending a private note, with passwords, documents, code secrets and messages floating securely from the screen

What people share with SecretNote

Anything you'd rather not leave sitting in an inbox or a chat log.

••

Passwords & credentials

Share login details, API keys, and tokens without leaving them in chat logs or email threads.

⛁

Sensitive documents

Send financial data, contracts, or personal info that should not persist in digital channels.

DevOps & IT secrets

Transmit SSH keys, database credentials, and config secrets safely between team members.

✉

Private messages

Send confidential notes that vanish, for moments that deserve true privacy.

a quick comparison

SecretNote vs other ways to share

Email and chat apps were not built for one-time secrets. Here is what changes when you use a tool that is.

Feature

SecretNote

Chat apps

End-to-end encrypted

Deleted after reading

Server never sees plaintext

No account to send a note

Leaves no message history

Expiration timer

Free to use

frequently asked

Frequently asked questions

Answers about encrypted notes, zero-knowledge security, and safe data sharing.

No. Encryption and decryption happen in the browser. The server only ever holds an opaque block of ciphertext it has no key for, and deletes it the moment it is read.

A random 256-bit AES key is generated in your browser, used to encrypt the note locally, then embedded in the link after the # symbol. Browsers never transmit the part after # to a server, so only the sender and recipient ever see the key.

Whoever opens the link first reads the note. The ciphertext is then destroyed, so anyone who follows finds an empty shell. Share the link through a channel you trust, and prefer the delete-after-read option for sensitive content.

No. There is no backup, log, or recovery. This is by design. Once the recipient opens the link, the ciphertext is erased permanently.

You choose an expiry from 1 hour up to 30 days when you encrypt the note. If nobody reads it by then, it is deleted automatically.

Text notes are capped at 512 KB. For larger content, use SecretFile, which supports files up to 100 MB.

No. Writing and sharing notes is completely free with no account, no email and no tracking - you open the page, write a note, and share the link. A free, optional account only unlocks a few advanced extras, such as generating several identical links at once.

In the European Union. We are subject to the GDPR and store only minimal metadata (the ciphertext and its expiry) that is deleted as soon as the note is read or expires.

More privacy tools

Everything you need to share private data safely - free, no account needed to get started, runs in your browser.

SecretScreen

Upload a screenshot and get a self-destructing share link. The image is encrypted before upload and deleted after the first view - no permanent hosting.

Share a screenshot →

SecretFile

Upload any file and share a one-time download link. The file is encrypted end-to-end and permanently deleted after the recipient downloads it.

Send a secret file →

Hash Generator

Instantly generate MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 hashes in your browser. Your input is never sent to the server.

Generate a hash →

Password Generator

Generate strong, random passwords with full control over length and character sets. Everything runs locally - your passwords never touch a server.

Generate a password →