BurnPony

BurnPony seals a note on your phone with AES-256-GCM, hands you one link, and steps out of the way. The recipient opens it in any browser — no app, no account — and after the last allowed view the note is gone. The server in the middle only ever holds ciphertext.

01- Write and seal Type the note on your phone. Before anything is uploaded, it's encrypted on the device with AES-256-GCM — the key is derived from 32 fresh random bytes, and those bytes never leave your phone in any request.

02 - Share one link You get a single link with the decryption key tucked into its #fragment — the part browsers keep to themselves. Send it over any channel, or let the recipient scan the QR code in person. Want a second factor? Add a passphrase and share it separately.

03 - It burns The recipient taps Reveal in any modern browser and the note decrypts right there. On the last allowed view, the server deletes the ciphertext in the same transaction. Anything unread burns anyway when the expiry you chose arrives.

Built so the middle holds nothing. Every design decision points the same way: the server stores what it cannot read, for as short a time as possible.

Sealed on your device AES-256-GCM with a key derived via HKDF-SHA256 from fresh random bytes — all on your phone, before a single byte is uploaded. The server receives ciphertext, full stop.

The key never travels The decryption key rides in the link's #fragment. Browsers never send fragments to servers — not to ours, not to anyone's. Whoever holds the link holds the key; the server never does.

Burns on the last view Set 1 to 100 views. When the last one is fetched, the ciphertext is deleted in the same database transaction — not on a cleanup schedule, not eventually. In the same moment.

Expires on schedule Pick 1 hour to 30 days. A sweep runs every five minutes and deletes anything past its time, read or not. Nothing lingers because nobody clicked.

Passphrase second factor Optionally require a passphrase, stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations and mixed into the key. Share it over a different channel and the link alone opens nothing.

Receipts, disclosed Turn on a read receipt and you'll know when the note was opened — and the recipient is told before they reveal it. BurnPony does not do silent read tracking.

Burn it early Every note you create appears in the Sent tab with live status — views used, opened times if receipts are on — and a burn button that deletes it from the server immediately.

A viewer you can read Recipients get a single self-contained page: no frameworks, no cookies, no external requests, locked down with a strict Content-Security-Policy. View Source is the audit.

No account, ever No sign-up to send, no sign-up to read, no username database, no analytics. There is nothing about you here to leak.