Share secrets securely with self-destructing links
Keep your secrets private and out of chat, email, Slack and Teams logs
Link Ready
Send it, then forget it.
Copy the link and share it however you like. For your security we won't show it again — once you leave this page, it's gone from here.
- One-time view
- Expires in 1 Day
Save this somewhere private. Opening it destroys the secret immediately — before anyone else can view it. Once burned, not even we can recover it.
- End-to-end Encrypted
- Zero-Knowledge
- No access logs
- Open source
How It Works
Three steps. No accounts required.
shhnote encrypts your secret in the browser before anything touches the network. The encryption key lives in the URL fragment — a part of the URL that browsers never send to servers.
01
Encrypt text/file(s)
Your secret is encrypted on your own device before anything is sent. The key to unlock it is never uploaded.
02
Share the link
It lives in the part of the link after the # — which browsers keep local and never send to a server.
03
Retrieve and it's gone
The recipient's browser unlocks it locally. A one-time secret is deleted from the server the moment it is opened; a timed one when it expires. Even we can't recover it.
Under The Hood
The cryptography, spelled out.
No hand-waving. Here's exactly what protects your secret, and where each piece runs — so you can verify the claims instead of taking them on faith.
Encryption
Authenticated symmetric encryption. Every secret is sealed with a 256-bit key and an integrity tag, so tampering is detected — not just left unreadable.
Key derivation
Optional passphrases are stretched with a memory-hard KDF, making offline brute-force attacks slow and costly even on purpose-built hardware.
Randomness
Keys and nonces are drawn from the browser's cryptographically secure generator. Never Math.random(), never predictable.
Key custody
The decryption key rides after the # in your link. Browsers never transmit the fragment, so the key that unlocks the secret never reaches our servers.
In transit
Only ciphertext ever leaves your device, carried over modern TLS. What we receive is an opaque blob we have no way to open.
At rest
We persist the encrypted blob, one-way hashes of the values used to find or burn it, its lifetime and a rounded expiry — nothing else. No plaintext, no keys, no sender or recipient metadata.
Use cases
Create a shhnote for anything
See how people are using shhnote everyday
DevOps & Engineering
Credentials & Keys
Stop pasting API keys, database passwords, and SSH keys into chat threads. Share them as one-time links that self-destruct after use. Integrate with CI/CD pipelines via the API.
Privacy-conscious users
Share without a trace
Works in Tor Browser at the Safer level. No CAPTCHAs, no browser fingerprinting, no external requests. Every font and asset is self-hosted.
IT & Onboarding
Provision access securely
Send new hires initial credentials, VPN configs, or Wi-Fi passwords without leaving traces in email threads or ticketing systems. Script it through the API for batch onboarding.
Legal & Regulatory
Compliance-sensitive records
Send a patient record, case file, or financial statement to a client or colleague without it sitting in an inbox that's subject to discovery, audit, or breach disclosure.
Personal
Everyday secrets
Send your accountant tax document passwords. Share streaming credentials with family. Give a contractor your alarm code. Send sensitive files securely. Simple enough for anyone.
Misc
Gift codes or surprise reveals
Send a gift card code, a surprise, scavenger/treasure hunt clue, or a reveal that vanishes after they've seen it.
Stop sharing sensitive info in plaintext
Create a one-time encrypted link in seconds. Or create a multi-view encrypted link that expires in a few hours or days. Add extra protection with a password. No account needed. Nothing that identifies you is kept.