How Self-Destructing Messages Work
No accounts, no setup, no server-side decryption. Here's exactly what happens between typing your secret and it vanishing forever.
The Flow
Four steps. Zero trust required.
Step 1
You write a message or pick a file
Type your secret or select a file to upload. Choose burn-after-reading, an expiry window, a max view count, and optionally a password — all before anything leaves your device.
Step 2
Your browser encrypts it locally
A random AES-256-GCM key is generated with the Web Crypto API, right there in your browser. Your message or file is encrypted before the first byte is sent to our servers.
Step 3
You get a one-time link to share
The encryption key is embedded in the URL fragment — the part after the # — which browsers never transmit in HTTP requests. Send the link however you like: chat, email, QR code.
Step 4
Your recipient reveals it — and it burns
They open the link, enter the password if one was set, and click reveal. Decryption happens entirely in their browser. The moment it's viewed, the server hard-deletes the secret for good.
What the server sees vs. what you see
What Our Server Sees
{
"id": "sec_8f92j...",
"ciphertext": "U2FsdGVkX1+...",
"iv": "8f3j29d...",
"burnAfterReading": true,
"expiresAt": "2026-12-31T23:59:59Z"
}Random noise. Mathematically impossible to decrypt without the key.
What Your Recipient Sees
{
"decrypted": "Meet me at the location.",
"status": "Verified ✓",
"key_source": "URL Fragment",
"burned": true
}The secret, decrypted locally in their browser. Never touches our servers in plaintext.
Ready to see it for yourself?