How it works
BurnThisNote encrypts your message inside your browser before anything is shared. The encryption key is made from your password using PBKDF2 (600,000 rounds, SHA-256), and the message is encrypted with AES-256-GCM using the browser's built-in Web Crypto API.
The encrypted data is placed in the part of the link after the # symbol. Browsers do not send that part to the server, so the encrypted note is not sent to us when the link is created or opened.
What expiry means
When a note expires, this website will refuse to show it. However, anyone who still has the link and password could try to read it using their own tools. For this reason, expiry is a convenience, not a guarantee. Do not rely on it for information that must never be seen again.
Choosing a password
The password is the only thing protecting the note. Use a long, random password, and send it through a different channel than the link.