Send a Secret Note
Turn a password or a private message into a link that works exactly once. The note is encrypted in your browser before it is uploaded, and the key travels in the part of the link that browsers never send to a server - so it arrives here as a blob we cannot open.
0 characters
Whichever comes first: being read, or this deadline.
Protects the note even if the link is intercepted.
Your one-time link is ready
Copy it now. The key is only in this link - we cannot rebuild it for you, and this page is the last place it exists.
You set an extra passphrase. Send it through a different channel than the link, or the protection is pointless.
How it stays private
When you press create, your browser generates a random 256-bit key, encrypts the note with AES-256-GCM, and uploads only the ciphertext. The key is never part of that upload.
Instead it is placed after the # in the link. Everything after a
# is a URL fragment, and browsers
deliberately never transmit fragments to servers - they are meant for scrolling to a heading. The recipient's
browser reads the key locally and decrypts there.
So our database holds an opaque blob and no key. This is not a promise about our intentions; it is a property of the design. The same construction is what PrivateBin and similar tools use.
When the note is revealed, the row is deleted inside the same operation that hands it over, so a second reader always gets "already read". If nobody opens it, the expiry deadline deletes it anyway.
One limit worth knowing: because we cannot read the notes, we cannot moderate them either. We rate-limit creation, cap the size and expire everything on a deadline, and any link reported to us is destroyed on sight - but content review is not possible by design.
Questions
Can you read my note?
No. The note is encrypted before upload and the key stays in the URL fragment, which browsers never send to a server. What we store cannot be decrypted by us.
What if a chat app previews the link?
Opening the link does not consume the note - the reader has to press "Reveal note" explicitly. That is specifically so link-preview bots in Slack, WhatsApp or mail scanners cannot burn a note before the person reads it.
Is this good enough for sharing passwords at work?
It is much better than pasting one into chat or email, where it stays in the log forever. For ongoing credential sharing across a team, a proper password manager with shared vaults is the right tool - this is for one-off handovers.
Is there a size limit?
Around 100 KB of text, which is far more than any password or message needs. There is also a limit on how many notes one connection can create per hour, to keep the tool from being used for bulk abuse.
The notes you keep, not the ones you send
This tool is for handing something over once. Snoq is for everything you keep: a free Windows notes app with an AES-256 encrypted database on your own disk, Argon2id key derivation, no account, no cloud, no telemetry.
Download Snoq for Windows