Secrets should not live in your chat history

How it works

1. Your browser encrypts the note. A random 256-bit AES-GCM key is generated locally with the Web Crypto API. Your note is encrypted before any network request is made.
2. Only the ciphertext is uploaded. The encrypted blob and its initialisation vector are stored on Cloudflare D1. The key is never part of that request.
3. The key travels in the URL fragment. Your link looks like /note/<id>#<key>. Everything after the # is a fragment, and browsers never send fragments to the server. The key lives only in the link you share.
4. The first reader destroys it. Opening the note runs a single atomic DELETE ... RETURNING query. The row is gone before the ciphertext reaches the reader's browser, where the fragment key decrypts it.

What we can and cannot see

Because the decryption key never reaches our infrastructure, there is no configuration, no subpoena and no database dump that reveals your note. Encrypted, it is meaningless to us.

• AES-256-GCM. Authenticated encryption via the browser's native Web Crypto API. A tampered ciphertext fails to decrypt rather than producing garbage.
• No plaintext, ever. The server stores a ciphertext, an IV and an expiry timestamp. It has never held a readable copy of any note.
• Single read, then gone. Deletion and retrieval happen in one atomic statement, so two people racing for the same link cannot both receive it.
• Expiry as a backstop. An unread note is deleted after the window you choose - from one hour to seven days. A scheduled job sweeps expired rows every hour.
• No accounts. Nothing to sign up for and no profile to build. Usage counters store a truncated hash of the IP address, never the address itself.
• Runs at the edge. Built on Cloudflare Workers and D1, so the note is served from the location nearest to whoever opens it.

Good practice when sharing

• Send the whole link. If the part after the # is lost, the note is unrecoverable. Some chat clients truncate long URLs - paste, then check.
• Use a different channel for context. Share the link in one place and mention what it contains somewhere else, so a single compromised inbox is not enough.
• Pick the shortest expiry that works. A note nobody opens should not linger for a week if an hour will do.
• Treat a dead link as a leak. If a recipient reports the note was already read, assume someone else opened it and rotate the secret.

Honest limitations

End-to-end encryption protects the note in transit and at rest. It cannot protect against everything, and we would rather say so plainly:

• Anyone who obtains the full link before the recipient does can read the note. The link is the credential.
• Once decrypted, the plaintext sits in the reader's browser and clipboard, outside our control.
• Like every web app, ExpireNote serves the JavaScript that performs the encryption. You are trusting that the delivered code is honest - the same trust model as any browser-based encryption tool.
• We record anonymous counters (notes created, notes read, page views) to keep the service running. No note contents and no raw IP addresses are stored.

Frequently asked questions

What is ExpireNote?

ExpireNote is a free tool for sharing confidential information - passwords, API keys, recovery codes - through a link that can be opened exactly once. After that single view, the note is permanently deleted from the server.

Can ExpireNote or Cloudflare read my note?

No. The note is encrypted with AES-256-GCM in your browser before it is ever sent to our servers, and the decryption key is carried only in the URL fragment (the part after #), which browsers never transmit. The server only ever stores ciphertext it cannot decrypt.

What happens after someone opens the note?

Opening the note runs a single atomic delete-and-return operation on the server, so the encrypted data is removed at the moment it is handed to the reader's browser. The same link cannot be opened a second time by anyone, including the original sender.

What happens if nobody opens the note?

You choose an expiry window when creating the note - from one hour to seven days. If it is never opened, it is automatically deleted once that window passes.

Do I need to create an account?

No. ExpireNote has no accounts, no sign-up and no login. You paste a note, get a link, and share it.

Is ExpireNote free to use?

Yes. There is no payment, subscription or usage limit beyond a per-note size cap and standard abuse-prevention rate limits.

What if I lose the link before the recipient opens it?

Since the decryption key lives only in the link itself and is never stored anywhere, a lost link cannot be recovered. The safest option is to create a new note and send a fresh link.

---

Ready to try it? Create a secure note - it takes one click and no account.