01 / One-time secret

Share a password once

Turn a password, API key, or recovery code into a one-time encrypted link. This tab encrypts with AES-256-GCM; the server only receives ciphertext. The key sits after # in the address bar and never enters HTTP. After the recipient opens the full link, it burns. Neither side needs an account.

AES-256-GCM Key after # Burns after read

0 / 32,768 bytes

Burns after 1 read by default. Unread links are also deleted when they expire.

Appears here after encryption

No link yet. After you paste a secret, the right side splits the query and the # fragment so you can confirm the key never entered HTTP. Without the fragment, ciphertext on the server cannot be decrypted.

02 / Checkable

Check who can see what

The current tab uses Web Crypto to draw a 256-bit key, then encrypts with AES-256-GCM. Upload fields are only ciphertext, an expiry, and a read count.

Where it runs 01 Encrypt locally, then upload. The server receives ciphertext, not plaintext.
Where the key lives 02 The key stays in the # fragment. The query has only the id and does not take the key with it.
Burns after read 03 Hard-deleted after the read limit or expiry. Opening again shows it has been burned.
What it cannot do 04 Screenshots still work. A lost link cannot be recovered. 32 KB max.
03 / FAQ

Before you share a password

Burn-Link is a one-time encrypted link: you encrypt a password or API key in the current tab with AES-256-GCM, and the server only stores ciphertext. The decryption key is appended after # in the address bar and never enters the HTTP request. After the recipient opens it and the read limit is reached, the ciphertext is deleted and cannot be read again.

How do I share a password securely? 01 Encrypt locally into a one-time link. It burns after the recipient opens it and the read limit is reached.
Can the server see plaintext 02 No. The server only receives ciphertext. The key never enters HTTP.
Does the recipient need an account? 03 No. Open the full link that includes # and decrypt locally.
Can it stop screenshots 04 No. It reduces repeat opens and plaintext stored on the server.
Is chat a safe way to send a password? 05 Chat history keeps plaintext. A one-time link is a better handoff.
Can I recover a lost link 06 No. The server has no plaintext backup. Use File Encryption Box for whole files
04 / Next

After you send

Use this page for a short text, once. Generating a password, cleaning outbound content, and backing up a file all stay in the browser. Plaintext, keys, and files are not uploaded by default.

Password Generator 01 Privacy Cleanup 02 File Encryption Box 03