Zero-knowledge encryption — your key never leaves your device

Share secrets that self-destruct

Passwords, API keys, files — encrypted in your browser, shared via a one-time link. The server never sees your data. Ever.

End-to-end encrypted

Burn after read

No account needed

End-to-End Encrypted

Zero Knowledge

Self-Destructs

Client-Side Keys

No Plaintext Stored

No Account Required

Features

Everything you need to share safely

No compromises. No accounts. No data retention. Just the right tools to share sensitive information without the risk.

Your secret is encrypted in your browser before a single byte leaves your device. We store only ciphertext — never your original data.

Set a view limit — 1 view, 5 views, or any number. The moment that limit is hit, the secret is permanently deleted from our servers.

Set a deadline: minutes, hours, or days. Whichever hits first — the view limit or the time limit — triggers permanent deletion.

Drag and drop any file — PDFs, zip archives, certificates, images, videos. Encrypted before upload, up to 500MB.

Add an extra layer with a password. Recipients need it to view — the password is never stored, only a hash for verification.

Every secret gets a QR code. Save it, print it, or let someone scan it directly. No link required.

Recipients can preview images, stream videos, read PDFs, and view syntax-highlighted code — all before downloading.

Enter recipient emails and we deliver the link, QR code, and password directly to their inbox. The safest way to share.

Paste code, config, environment variables, or JSON. Automatic language detection with beautiful syntax highlighting.

How it works

Type a secret, paste a password, or drop any file. Choose your expiry: by views, by time, or both.

Your data is encrypted entirely in your browser. The encryption key never leaves your device — it lives in the URL fragment.

Copy the link, download the QR code, or let us email it directly to your recipients with optional password included.

When opened, the secret is decrypted locally in the recipient's browser. Once the view limit or time limit is hit, it's gone permanently.

No sign-up. No tracking. No data retained after it self-destructs. Just a link that vanishes when it should.