Question 1

How does burnote keep my secret safe?

Accepted Answer

Your secret is encrypted with AES-GCM inside your browser before it ever leaves your device. The decryption key is placed in the URL fragment (after the #), which browsers never send to servers. When your recipient opens the link, the server returns the ciphertext once and deletes it immediately — there is no way to read the same secret twice.

Question 2

Is burnote free?

Accepted Answer

Yes. burnote is a free service from Osmicro Networks. No accounts, no ads, no limits on how many secrets you can send.

Question 3

What happens if my recipient never opens the link?

Accepted Answer

Every secret has an expiry between 5 minutes and 14 days. Once the expiry passes, the record is permanently deleted from the database, even if the link was never clicked.

Question 4

Can a preview link (Slack, iMessage, email scanner) accidentally burn my secret?

Accepted Answer

No. burnote only destroys a secret when the recipient explicitly clicks the reveal button, which sends a POST request. Automatic link previews, prefetchers, and crawlers only make safe GET requests, so they cannot consume a one-time link.

burnote — free self-destructing encrypted links for sharing passwords and secrets