What changed

1.0 - Current

• Client-side AES-256-GCM encryption. Your note is encrypted in your browser with the Web Crypto API before anything is sent over the network. The server only ever receives ciphertext.
• The decryption key never touches the server. It is carried solely in the URL fragment (the part after #), which browsers never transmit to any server by design.
• Guaranteed single read. Retrieving and deleting a note happen as one atomic database operation, so a link can be opened exactly once, even if two people try at the same instant.
• Configurable expiry. Choose 1 hour, 12 hours, 24 hours, or 7 days for how long an unread note stays available before it is automatically deleted.
• No account required. Create and share a note without signing up or logging in.
• Per-IP rate limiting. Note creation and retrieval are rate-limited to keep the service available for everyone. If you hit a limit, you'll see a "too many requests" message and can retry shortly after.
• Draft recovery. If you refresh the page while writing a note or right after generating a link, your in-progress draft or link is restored from your browser's own session storage - it is never sent anywhere to enable this.