Tutorials
How to Send a Self-Destructing Message, Step by Step
A step-by-step guide to sending a message that deletes after reading, plus where app-based disappearing mes...
Built around the secret
Six things working in your favour, every time you press send.
AES-256 from your browser to the link.
Notes are encrypted client-side before they ever touch our servers. Only the link holder can decrypt them - we can't, and neither can anyone reading the database.
Self-destructing.
One read and the ciphertext is wiped from disk. No backups, no shadow copies.
Zero log.
No analytics, no IP retention, no telemetry on your message body. Ever.
Passcode layer.
Add a passcode the recipient must know. Out-of-band trust, in two channels.
Time-bound.
From one hour to thirty days. After that the note is gone, with or without a read.
Tell me when it's read.
Optional email pings the moment your link is opened - so you know your message reached the right person, and exactly when. No more "did you get it?" follow-ups.
How it works
Four steps. Roughly twenty seconds. No account.
1
Write
Type or paste the secret. Set a lifetime, view limit, optional passcode.
2
Encrypt
AES-256-GCM runs in your browser. The key never leaves the URL fragment.
3
Send
Share the one-time link via WhatsApp, email, or however you prefer.
4
Erase
Message self-destructs after being read or when time expires.
Security
What's actually under the hood
A short, honest list. No marketing claims we can't defend.
AES-256-GCM, in your browser
Authenticated encryption. The decryption key lives in the URL fragment, never in our database.
EU-hosted, hardened infra
HTTPS-only, HSTS, strict CSP. CSRF tokens on every write, rate limits on every read.
Reaper sweeps every hour
Expired ciphertext is hard-deleted. We can't restore it. We don't want to.
No accounts to breach
No login, no profile, no third-party trackers on note pages. There's nothing to leak.
Open. Auditable. Yours.
The full source is on GitHub. Read it, fork it, run it on your own server.
As featured in
Field notes
All articles →
From the blog
Best Practices
When a screenshot ruins everything: designing secret-sharing workflows that survive human error
End-to-end encryption protects secrets in transit, but it can't stop a recipient from screenshotting a one-...
Best Practices
What makes a secret-sharing channel trustworthy: a framework for choosing the right tool
Not every sensitive secret deserves the same delivery method. Here is a practical framework for matching th...
