once_

Send something sensitive that vanishes after one read. It's encrypted right here in your browser, locked behind a passphrase, and wiped the moment it's opened — like a message that reads itself, then combusts.

drop in the secret

A password, an API key, launch codes, the Wi-Fi password — anything meant for their eyes only. Photos optional.

pick a passphrase

This is the key that unlocks it — so share it on a separate channel from the link (a text, an email, a phone call). Split the link and the key, and one intercepted message reveals nothing.

forge the one-time link

Encryption happens locally — only ciphertext ever leaves your device. Set the fuse, then generate the link.

on the receiving end?

Handed a one-time link? Paste it below and punch in the passphrase — the clock is already ticking.

how this works
  1. Drop in the secret. Type a note and/or attach a few optional photos.
  2. Your browser handles the crypto. Your passphrase derives the key (PBKDF2, 600k rounds → AES-256-GCM). Our server only ever sees ciphertext — never your text, photos, or passphrase.
  3. Split the two halves. Send the link one way (email/chat) and the passphrase another (text/call), so intercepting one gets you nowhere.
  4. It self-destructs. After the first read — or when the timer hits zero — the secret is wiped from memory. No backups, no undo, by design.