MyPassGen
Burn-after-read link
Turn a password, API key, or recovery code into a one-time encrypted link. The key lives after # in the URL. The first read burns it. Create it here; the recipient does not register.
How one-time encrypted sharing works
Chat apps and email keep plaintext in history. A burn-after-read link is for a short secret that should be seen once: AES-256-GCM in the browser, ciphertext stored briefly on the server, decryption key after # — that fragment is not sent with the HTTP request.
The recipient opens the reading page and decrypts without an account. The first successful read burns the ciphertext. You can also set a 1-hour, 24-hour, or 7-day expiry, and up to 10 reads. Each note is capped at 32 KB — passwords, key fragments, and short notes, not whole files. Use online file encryption for files.
- Send the full link. Without the part after #, it cannot be decrypted
- A lost or already-burned link cannot be recovered. Create a new one if you need to send again
- It does not stop screenshots or forwarding. It reduces repeat opens and server-side plaintext storage
FAQ
Does the recipient need an account?
No. Creating and reading both work without an account. The recipient opens the reading page. After the first successful read the note is burned; opening it again shows that it has already been destroyed.
Can the server see the plaintext I shared?
No. The text is encrypted in the browser before ciphertext is uploaded. The decryption key lives in the URL fragment after # and is not sent with the HTTP request. The algorithm is AES-256-GCM; see MDN AES-GCM.
Can I recover a lost or expired link?
No. There is no server-side plaintext copy. Send the full link and open it before it expires. To send again, create a new link.
Does burn-after-read stop screenshots?
No. It reduces repeat opens and long-lived server plaintext. It cannot stop copy, screenshots, or forwarding. Use it only when you trust the other person to read once and stop.