One-time encrypted notes
Paste a secret. Share the link. It burns after one read.
Encrypted in your browser. The server only ever stores ciphertext.
Your one-time link
Share the passphrase separately — never in the same chat as the link.
How it works
The key rides in the link.
It never reaches the server.
- 01
Seal
Your browser makes a random 256-bit key and encrypts the text with AES-GCM. Only ciphertext is uploaded.
- 02
Share
You get one link. The key sits after the
#, the one part of a URL browsers never send to a server. - 03
Burn
The first Open & burn hands over the ciphertext and deletes it in the same transaction. Anyone after that sees “gone”.
What the server sees
Zero plaintext.
Just noise with an expiry.
Edit the demo text — the ciphertext changes, the server never sees the words.
{ "v": 1, "ct": "…", "iv": "…" }
- plaintext bytes sent
- 0
- key bytes sent
- 0
- cookies
- 0
Holder tier
Bigger notes.
Longer fuses.
Hold ≥ 500,000 SINGENOTE tokens to unlock 10 KB notes that live up to 7 days. Sign a message — no transaction, no gas.
Holding unlocks bigger and longer notes. No staking, no rewards, no promises.
- 1,024 bytes of text
- Expires in 1 hour or 24 hours
- No wallet, no account
- 10,240 bytes of text
- 1 hour, 24 hours or 7 days
- Message signature, 1-hour session
Questions
Before you paste.
Can a note really be read only once?
Yes. Opening a note hands the ciphertext to exactly one browser and deletes it from the database in the same transaction. If two people press Open & burn at the same moment, one gets the note and the other sees “This note is gone.”
What does the passphrase add?
A second secret that is not in the link. The note key is mixed with a key derived from your passphrase (PBKDF2, 300,000 rounds), so the link alone can't decrypt it. A wrong passphrase is rejected before anything is deleted — the note stays intact. Five wrong tries lock the note for 10 minutes.
Will a link preview burn my note?
No. Chat apps that unfurl links only fetch the page. The note is only consumed by a button press that sends a POST request, which preview bots don't do.
What happens if nobody opens it?
It expires on its own: 1 hour or 24 hours (7 days for holders). A sweeper deletes expired notes every minute, and expired notes can't be opened even before that.
Do you keep logs?
No accounts. No cookies. No access logs on note pages or the API. No third-party requests — fonts and scripts are served from singenote.pro. Rate limits are counted in memory and forgotten.
What doesn't this protect against?
A recipient who screenshots or copies the text, a compromised device on either end, weak passphrases, links pasted into chats that keep history, and a malicious server operator swapping the JavaScript. It has not been independently audited. Read the full list.