1. Create a key and encrypt on this device
The browser draws a 256-bit random key with Web Crypto, then encrypts your text with AES-256-GCM. Plaintext appears only in this tab and is not sent as a request body.
BURN-LINK
Share a password securely with a one-time encrypted link
Neither side needs an account. Encrypt a password, API key, or recovery code in this tab with AES-256-GCM. The server stores only ciphertext. The decrypt key sits after # in the link and does not enter the HTTP request. After one open, the ciphertext is deleted.
✓ AES-256-GCM
✓ Key after #
✓ Burned after reading
✓ No account
01
Encrypt on this device, then create a one-time secret
Your plaintext is never uploaded. Set expiry and read count if you need to. Defaults are 24 hours and 1 read. Each item is capped at 32 KB.
0 / 32,768 bytes
Unread items are also deleted when they expire
1–10 times
Send the entire link including #. Without the fragment, ciphertext on the server cannot be decrypted.
Full link
Query
The server can see the ciphertext id, not the key.
Fragment key
Stays in the browser and is not sent with the HTTP request.
A lost link cannot be recovered. After the first successful read, the ciphertext is hard-deleted.
02
Why a one-time secret keeps plaintext off the server
The server never gets plaintext or the decrypt key. It only holds ciphertext briefly, then deletes it after a successful read or expiry.
2. The server receives ciphertext only
The upload fields are ciphertext, expiry, and max reads. After an unguessable id comes back, this page appends the key to the fragment: s.html?id=…#key.
3. One read, then ciphertext is deleted
The recipient opens the full link, takes the key from #, and decrypts on their device. After the first successful read, the server hard-deletes the ciphertext. Opening it again says it has been burned. The recipient does not need an account either.
03
Key placement, limits, and what a Burn-Link cannot stop
Burn-Link answers how to send a short secret once. Algorithm, key placement, size limits, and what it cannot stop are written below.
Uses AES-256-GCM. Ciphertext format is Base64(12-byte IV + ciphertext + 16-byte tag). Compute runs through the browser Web Crypto API.
The key sits only in the URL # fragment: s.html?id={id}#{key}. The query has the id only. Do not move the key to ?key=—that enters access logs.
Each item is capped at 32 KB, enough for passphrases, key fragments, and short notes. Expiry can be 1 hour, 24 hours, 7 days, or burn after reading only. Reads are 1–10. For a whole file, use File Encryption Box.
It cannot block copy, screenshots, or forwarding. There is also no server-side plaintext backup. It reduces repeat opens and long-term plaintext on the server. It does not replace trust.
FAQ
One-time secret FAQ
Create a one-time encrypted link. The text is encrypted in this tab with AES-256-GCM, and the server receives only ciphertext. The decrypt key sits in the link’s # fragment and is not sent with the HTTP request.
No. They open the full link and decrypt on their device. After the first successful read, the server deletes the ciphertext. Opening it again reports that it has been burned.
No. The server has no plaintext copy and does not store the key separately. Send the full link including #, and open it before it expires. To send again, create a new link.
No. It cuts repeat opens and long-term plaintext on the server. It cannot block copy, screenshots, or forwarding. Use it only for a one-time handoff when you trust the recipient.
Need a new password, cleaned text, or a file backup too?
Send a short secret once on this page. Longer prep or a whole file can stay in the browser.
Password Generator
Create a new password on this device, then send it once from this page. Plaintext is not uploaded.
Privacy Cleaner
Before you send a chat log or ticket, strip tracking parameters and mask phone numbers and ID numbers.
File Encryption Box
Over 32 KB, or when you need a whole-file local backup, switch to streaming AES-256-GCM. One file can be up to 5 GB.