Private Note Sender: Share an Encrypted Note by Link
Write a note, lock it with a password and send the link. The note is encrypted in your browser and travels inside the link, so it's never stored on our servers.
- AES-256 in your browser
- Nothing stored on our servers
- No sign-up
Send the link and the password through two different channels, such as chat and a phone call.
Longer is stronger. Generate makes a random 20-character password.
How to test it
- Press Copy, then open the link in a private or incognito window. Or press Test this link to open it in the Open a note tab.
- Type the password. Your note should appear exactly as you wrote it.
- Try a wrong password. You should see Wrong password or damaged link.
- Change any one character after the # and open it again. It should fail the same way, which shows the link can't be altered without being noticed.
- For expiry, create a test note with 1 hour and open it after the hour. The page should say the note has expired.
Nothing here is saved. Closing or reloading the tab clears the note and password.
Someone sent you a private note. The link has been removed from your address bar so it doesn't stay on screen.
How this private note sender works
Encrypted before it leaves you
Your browser encrypts the note with AES-256-GCM using the Web Crypto API. With a password, the key comes from PBKDF2-SHA256 with 600,000 rounds and a random salt.
The note lives in the link
The encrypted note goes after the # in the link. Browsers don't send that part to the server, so we never receive or store your note.
Expiry is a lock, not deletion
The expiry time is sealed inside the encrypted note, and this page refuses to open it afterwards. It can't delete a link that's already in someone's chat, though.
Check it yourself. Open your browser's developer tools (F12), choose the Network tab, then create and open a note. No requests are made. One exception: links made by the previous version of this tool load a small decryption library from jsDelivr when opened. Any script running on a page can read the part after #, so this page removes it from the address bar the moment it's read.
Sharing problems this tool fixes
Find the problem you ran into. Each fix takes you to the part of the tool that solves it.
| Your problem | How this tool fixes it | Fix |
|---|---|---|
| I need to send something private | ||
| I need to send a Wi-Fi password or a login to someone | Write it as a note and lock it with a password. Send the link by chat and read the password out on a call, so neither message alone reveals anything. | |
| I don't want the secret sitting in my chat history for years | The chat only ever holds a scrambled link. Pick a short expiry and this page stops opening it after that time. | |
| I don't want to agree a password with the other person | Choose Link only. The key goes inside the link, so anyone with the full link can read it. Send it only through a channel you trust. | |
| I need a strong password for the note, fast | Generate makes a random 20-character password without look-alike characters, so it's easy to read out on a call. | |
| The note won't open | ||
| "Wrong password or damaged link" | Either the password is wrong or part of the link is missing. Long links are sometimes cut by chat apps, so the tool warns you when a link is long. Paste the whole link into Open a note. | |
| The link opens this page but no note appears | The part after # was lost, often by an email app or link preview. Ask the sender to copy the link again, or paste it into Open a note. | |
| "This note has expired" | The sender chose an expiry time that has passed. Ask them to create a new note. | |
What happens to your note
When you press Create secure link, your browser does three things. It turns your password into an encryption key, encrypts the note together with its expiry time, and writes the result into the link.
key = PBKDF2-SHA256(password, random salt, 600,000 rounds)
data = AES-256-GCM(key, random IV, note + expiry time)
link = page address # pn1 . salt . IV . data
AES-GCM also adds an authentication tag. If a single character of the link changes, or the password is wrong, decryption fails instead of showing scrambled text. With Link only, a random 256-bit key replaces the password and is written into the link.
The password is the weak point. 600,000 rounds make each guess slow, but a short or common password can still be guessed. A random 20-character password makes guessing impractical under normal attack conditions.
Sources: OWASP Password Storage Cheat Sheet (PBKDF2 rounds), NIST SP 800-38D (AES-GCM), RFC 3986 (the # fragment).
Mistakes that expose a private note
Encryption only protects the note if the link and the password stay apart.
Anyone who sees that message can read the note. Send the password another way, such as a call or a different app.
With Link only, the link is the key. Everyone in the group, and anyone they forward it to, can open the note.
A weak password undoes the encryption. Someone who gets the link can try common passwords offline without limit.
Expiry doesn't delete anything. If you shared a real password, change it once the other person has used it.
Habits for sharing secrets safely
Do
- Send the link and the password through two different channels.
- Choose the shortest expiry that still gives the other person time to open it.
- Change shared passwords or keys once they've been used.
- Test a link in a private window before you send something important.
- Use a password manager's sharing feature for secrets you share with the same people often.
Avoid
- Putting the password in the same email or chat as the link.
- Sending bank PINs, card numbers or OTP codes to anyone who asks for them.
- Reusing the same note password for different people.
- Opening notes on shared or public computers.
- Posting Link only notes anywhere public.
Frequently asked questions
Short answers about storage, expiry, passwords and links that won't open.
Where is my note stored?
Inside the link itself, encrypted. The note is encrypted in your browser and placed after the # in the link, a part browsers don't send to our server. We don't store notes, and we can't read them. Anyone who has the link holds an encrypted copy, which is unreadable without the password.
Does the note really self-destruct?
No tool that works this way can delete a link once it's sent. After the expiry time this page refuses to open the note, but the link still sits in the chat or email where you shared it, and someone with the password and the right skills could decrypt it with their own code. Treat expiry as a safety net, and change any password you shared once it has been used.
What happens if I forget the password?
The note can't be opened. There is no reset and no copy on our side, so the only fix is to create a new note.
How strong is the encryption?
Notes are encrypted with AES-256-GCM. With a password, the key is made from it using PBKDF2-SHA256 with 600,000 rounds, which slows down guessing. The weak point is the password itself, so use the Generate button for a long random one.
Can I share a note without a password?
Yes. Choose Link only and the key is put inside the link. Anyone who gets the full link can read the note, so send it only through a channel you trust.
Why did the link disappear from the address bar after I opened it?
The page removes the encrypted part of the link from the address bar as soon as it reads it, so it doesn't stay on screen or in your browser history. Reloading won't bring the note back. Open the original link again if you need it.
Why won't my link open?
Usually the link was cut off by a chat app, the password is wrong, or the note has expired. Check that you copied the whole link, including everything after the # sign, and paste it into the Open a note tab.