A deadline, even if nobody opens it
After reading, 1 hour, 24 hours, 7 days, or 30 days. An unread note should not sit forever.
Independent review · not the service
A note burns after a single reading
Privnote is a free way to send text that cannot be reread. The link opens once, then the message is deleted. No account, no app, no attachments.
- Entry
- A minute, no signup
- How long it lives
- One read, or a timer
- Where the key is
- In the link, after #
- What it is not
- Files, history, a public audit
01 · What it is
Privnote covers an ordinary gap: a password, a recovery code, or an address you do not want sitting in a chat history. You write a note and take a unique link. The person on the other end sees a warning, reads the text — and the note stops existing.
This is not “I’ll delete the message later.” The sender has no copy behind that link either. There is no thread to scroll a month from now, and no profile the conversation is attached to.
- FreeNo account and no payment.
- One reader, in practiceWhoever opens it first is the one who read it.
- Plain text onlyThe secret has to fit in words.
02 · How it works
- 01
Write it in the browser
No account and no app. On privnote.com it is an ordinary text box. The note has not gone anywhere yet.
- 02
The key stays in the link
The service says it encrypts the text on your side. The key sits after the #. Browsers do not send that part of a URL to the server.
- 03
One look, then nothing
The recipient sees a warning, reads the note, and the link dies. A second visit — for anyone, including you — shows nothing.
Before the hash is the note’s address on the server. After it is the key, which the browser keeps to itself. By the rules of a URL, only the left side is sent.
A password on a second channel
Send the link and the password apart. Email for one, a call for the other — one intercepted channel is not enough.
Mail when it is destroyed
You can learn that the envelope was opened. The cost is metadata: the address the confirmation goes to.
Text only
No photos, no PDFs, no archives. If the secret is a file, Privnote is the wrong tool.
03 · Demo on this page
Burn a practice note. The real service is not required.
A teaching ritual, not the service. The text lives only in this tab and is wiped after it is “read.” Nothing is encrypted and nothing is sent.
Burned this session: 0
Recipient side
The envelope appears here after you create a link.
One look. The second is empty.
04 · Limits
The model is strong until the link, and until the closed code
Splitting “ciphertext on the server, key with whoever holds the link” is a sound design. The weak point is almost never the formula. It is who holds the URL, and the fact that outsiders cannot check the formula.
The link is the secret
Whoever holds the URL can read the note. Sending it in the same chat you were trying to avoid buys almost nothing. A screenshot on the recipient’s phone also stays.
The code is closed
“Even Privnote cannot read the text” cannot be checked against a public implementation. Write-ups in 2026 noted that the page loads an old AES library — an unauthenticated mode its author archived in 2018. That is not a verdict on the idea. It is also not an audit.
The server knows a note existed
Until it is opened, ciphertext sits somewhere. An email receipt adds an address and the fact of a read. Contents are one thing. Metadata is another.
The author is not signed
Privnote does not prove who sent the link. Trust in the sender lives in the channel you used to exchange the address.
05 · When to use it
Use it
- A one-time password, a booking code, a number that should not settle into a group chat.
- Someone who does not use Signal and will not install another app.
- A secret the sender also does not need to keep “just in case.”
Skip it
- Contracts, records, anything you will have to show again.
- Files, photos, and a long conversation.
- A channel someone else already reads. A link does not fix a compromised messenger.
Next to the other options
Privnote
Role. A one-time envelope
What remains. After reading — nothing
Scrutiny. Closed code. You trust the architecture
Signal
Role. An actual conversation
What remains. History on the devices
Scrutiny. Open client. Easier to inspect
Email and ordinary chat
Role. Everyday life, not secrets
What remains. Archives, backups, “deleted” copies
Scrutiny. The service can usually read it
06 · Questions
Is this privnote.com?
No. This page is an independent review. The demo does not encrypt anything and does not send it anywhere. The service itself lives at privnote.com.
Can a note be opened twice?
No. The first reading destroys it for everyone, including the author. If you need to reread it, Privnote is the wrong job.
Can the service see the text?
On the claimed design, no: the server stores ciphertext, and the key stays in the URL fragment after #. That cannot be verified from open source, so treat the promise as a description of the architecture, not as an audit result.
What if someone intercepts the link?
They read the note instead of the recipient — or as well as them, if they get there first. A password sent on another channel closes part of that gap.
Is there an app, or attachments?
No. A browser, plain text, one link. For files and an ongoing conversation, use a messenger with end-to-end encryption.
The short verdict
Privnote is a good envelope you cannot open twice. It does not replace an end-to-end messenger, and it is not a publicly audited cryptosystem. For a one-off secret between two people, it fits. For anything that has to survive the day, it does not.