How to send a private, encrypted note
- Type your note: a Wi-Fi password, door code, bank details for a friend, or a personal message.
- Optionally add a password. Then the link alone is not enough to read it.
- Press Create encrypted link and send the link. If you used a password, share it another way, for example by phone.
- The recipient opens the link and the note is decrypted in their browser.
How it works, and its limits
The note is encrypted with AES-256-GCM using the Web Crypto API. Without a password, a random 256-bit key is generated and placed in the link after the # sign, together with the encrypted text. Browsers never send the part after # to a web server, so the note does not pass through or get stored on any server, including ours. With a password, the key is derived from it with PBKDF2 (300,000 iterations), and the link only contains the encrypted data.
Be clear about what this protects against. Because the whole note lives in the link, anyone who gets the link (and the password, if used) can read it, as many times as they like: notes do not self-destruct, and you cannot delete one after sending. What it prevents is your secret sitting in plain text in chat logs, email archives, cloud backups and notification previews. Messaging apps that preview links never see the content, because the decryption happens only when the page runs. For the best protection, use a password, send it separately, and ask the recipient to delete the message after reading.
Does the note self-destruct?
No. There is no server copy to destroy. Anyone with the link can open it, so add a password for sensitive notes.
Can Buffermint read my note?
No. The note and key never reach a server; they exist only in the link.
How long can a note be?
A few thousand characters works everywhere. Very long notes create long links that some apps may cut off.