A burn after reading message is a note designed to be read once and then destroyed. The phrase comes from old instructions printed on secret documents. Today it usually means a one-time link: the note is stored encrypted, shown to the person who opens it, then deleted so the link stops working.
Key takeaways
- "Burn after reading" began as an instruction on sensitive paper documents: read it, then destroy it so no copy survives.
- A modern burn after reading note is an encrypted message behind a one-time link that is deleted after it is viewed or after a time limit.
- The deletion is real, but it cannot stop the recipient from copying, photographing or screenshotting the text while it is open.
- If you open your own link and it is already gone, someone else may have read it first, so change whatever was in it.
- Use a burn after reading link for one-off secrets; use a password manager for credentials you share over and over.
What does "burn after reading" mean?
The phrase is an instruction: read this, then destroy it. It comes from the world of secret paper, where the safest copy of a sensitive message was no copy at all once its job was done.
Spy fiction made the phrase famous, and governments really do handle sensitive waste this way. Offices that work with classified material use "burn bags" for papers that must be destroyed rather than thrown out. The idea is simple: a document that no longer exists cannot be found in a drawer, a bin or a filing cabinet years later.
Most people now meet the phrase in a different setting. They see it on a website that offers to send a private note, or they get a link from a colleague with a warning that it only works once. The 2008 Coen brothers comedy of the same name also keeps the phrase in circulation, which is why plenty of searches start out of plain curiosity.
How does a burn after reading message work today?
Nobody strikes a match anymore. A digital burn after reading message replaces the fire with two things: encryption while the note is waiting, and deletion once it has been read.
Here is the typical flow on a self-destructing note service:
- You write the note. You paste text into a form, such as a door code, a Wi-Fi password or an API key.
- The service encrypts and stores it. On SecureNotes, each note is encrypted with AES-256 using its own random key before it is stored, so notes are not sitting around as readable text.
- You get a unique link. That link is the only way to reach the note. You send it by text, chat or email.
- The recipient opens it. The note is decrypted and displayed.
- The note is destroyed. Once the view limit or time limit is reached, the stored note is deleted and the link stops working.
The important shift is where the secret lives. With an ordinary chat message, the password sits in your history, the recipient's history and any backups, indefinitely. With a one-time secret link, the chat history only holds a link that leads nowhere once the note is gone.
What happens to a burn after reading note after it is opened?
This is the "burn" part, and it happens on the server, not on the recipient's phone. The service keeps track of how many times the note has been viewed and how long it has existed.
On SecureNotes, the sender decides when that happens:
- After a number of views: 1, 3, 5 or 10.
- After a time limit: 1 hour, 24 hours, 7 days or 30 days.
- Whichever comes first: for example, one view or 24 hours, so an unopened note does not linger forever.
A single view is the classic burn after reading setting. Allowing a few views helps when you know the recipient might open it on their phone first and then need it again on a laptop. The trade-off between counting views and counting hours is bigger than it looks, and it is worth reading about self-destruct versus time-based expiration before you pick a default.
After the limit is reached, anyone who opens the link gets nothing. That includes the recipient, the sender and anyone who finds the link in an old email thread or a forwarded message.
Burn after reading link vs other disappearing messages
"Disappearing" means different things in different tools. Some delete the content, some just hide it, and some only work if both people use the same app. Here is how the common options compare.
| Method | What gets destroyed | Needs the same app? | Can the recipient still keep a copy? | What stays in your history |
|---|---|---|---|---|
| Paper note, burned | The only physical copy | No | Yes, by copying it down or photographing it | Nothing |
| Disappearing messages in a chat app | Messages after a set time, in that chat | Yes | Yes, via screenshot or another device | Depends on the app and settings |
| Burn after reading link | The stored note, after views or time run out | No, it opens in a browser | Yes, while the note is open | A link that no longer works |
| Plain email or text | Nothing | No | Yes | The full secret, indefinitely |
The burn after reading link wins on reach. You can send it to someone on any app or email account, and it still self-destructs. Chat app timers only protect you inside that app, and only if the other person has not turned off the setting or backed up the chat.
How to send a burn after reading message
Say a landlord needs to give a new tenant the lockbox code, or a developer has to pass an API key to a contractor. Here is how to do it so the secret does not stay in anyone's inbox.
- Open the note form. Go to SecureNotes and create a self-destructing note. There is no account or sign-up.
- Paste only the secret. Text up to 10,000 characters. Leave out context that would make it useful to a stranger, such as the street address next to the door code.
- Choose when it burns. Pick a view limit (1 view for the classic setting) and a time limit, such as 24 hours, so an unopened note still expires.
- Add a passcode if the stakes are high. The recipient has to enter it before the note opens.
- Turn on the read notification if you want proof. SecureNotes can email you when the note has been read.
- Send the link. Use whatever channel you normally use, or let SecureNotes email the link for you.
- Send the passcode another way. If the link went by email, read the passcode out on a call or send it by text. Never put both in the same message.
For a longer walkthrough with more examples, see how to send a self-destructing message, step by step. If you send secrets from scripts or internal tools, the SecureNotes API creates the same kind of note programmatically.
What a burn after reading message can't protect against
Self-destruction solves one specific problem: secrets piling up in message history. It does not make a message untouchable. These are the gaps people run into most.
The recipient can still keep it
Once the note is on screen, the reader can copy it, screenshot it or photograph it with another phone. The original burns; the copy does not. Only send a burn after reading note to someone you would trust with the secret anyway.
Someone else can open the link first
The link is the key to the note. If it is forwarded, sits in a shared inbox, or is opened by someone looking over the recipient's shoulder, that person sees the secret and the real recipient gets a dead link. Treat that as a warning sign: if the recipient says the link was already used, change the password or code.
Link previews and scanners
Some chat apps and email security filters fetch links automatically to build previews or check for malware. Depending on the service, that visit can count as a view. If recipients keep reporting dead links, allow a couple of views or add a passcode so an automated visit cannot read the content.
Sending the passcode with the link
A passcode in the same message as the link adds nothing. Anyone who has one has both. Split them across channels.
Leaving the secret alive elsewhere
It is common to send a perfect one-time link and then leave the same password in a shared doc, a ticket or a sticky note. The note burned, but the secret did not. Check where else it lives.
Treating "burned" as "never existed"
A destroyed note cannot be opened again, but the fact that you sent a link, when you sent it and who you sent it to stay in your chat or email records. A burn after reading message is private, not invisible.
When to use something other than a burn after reading note
One-time links are best for one-off handoffs: a temporary password, a Wi-Fi code for a guest, a recovery code, a database connection string for a new hire. They are not the right tool for everything.
- Credentials a team uses every day: a password manager with shared vaults is better, because the secret needs to persist and be updated.
- Payments: a payment link or the vendor's own secure portal beats sending card numbers in any note.
- Something you need to confirm by voice: if you are worried about impersonation, call the person on a number you already have before you send anything.
- Files: SecureNotes handles text only, so documents need a different method.
Whatever you choose, the underlying rule from the OWASP Secrets Management Cheat Sheet applies: limit how many places a secret lives and how long it lives there. A burn after reading message is one simple way to keep that number at zero once the handoff is done.
Frequently asked questions
Is a burn after reading message the same as a Snapchat message?
Not quite. Disappearing messages in apps like Snapchat only work inside that app, and both people need it installed. A burn after reading link opens in any browser, so you can send it by text, email or any chat app. In both cases the recipient can still take a screenshot, so neither stops a determined reader from keeping a copy.
Can a burn after reading note be recovered after it is deleted?
Once the view limit or time limit is reached, the note is deleted and the link stops working for everyone, including the sender. There is no undo or recovery button. If the recipient missed it, you need to create a new note. That is the point of the design: nobody can come back to the secret later.
What happens if someone else opens my burn after reading link first?
They see the note, and when the real recipient opens the link it no longer works. That dead link is useful information: it tells you the note was read by someone. If that happens, assume the secret is exposed and change the password, code or key it contained before sending a new one.
Does the recipient need an account to read a burn after reading message?
No. On SecureNotes neither the sender nor the recipient needs an account or sign-up. The recipient just opens the link in a browser. If you added a passcode, they also need to enter it, so make sure they receive it through a different channel than the link itself.
Can I send a file as a burn after reading message?
SecureNotes only handles text, up to 10,000 characters, with no file attachments. That covers passwords, codes, API keys, account numbers and short instructions. For documents or images you will need a different tool, ideally one that also limits how long the file stays available and who can open it.
How long does a burn after reading link stay active if nobody opens it?
It depends on the time limit the sender picked. On SecureNotes you can choose 1 hour, 24 hours, 7 days or 30 days, combined with a view limit. Whichever comes first ends the note. Pick the shortest window that gives the recipient a realistic chance to open it.
