Share it.
It turns to ash.
Send a password, file, or sensitive text through a self-destructing link that even we can't read. The encryption key lives in the URL fragment. The server only ever sees ciphertext. After they read it, it's gone.
9Iv0Q7Xk2PwR4Zm8Bn5Vq1Ys6Tc3Lg9Fh2Wr7Np4Dx8Ak6Mj1Gh3Qy5Lz7Vb9Cd2Sf4Gt6Hm8Jk2Lr4Vn6Wx8Yz0Ab3Cd5Ef7Gh9Jk1Lm3Np5Qr7St9Uv1Wx3Yz5Bc7De9Fg1Hi3Jk5Lm7N
Three steps. No middleman.
The zero-knowledge design means trust is structural, not promised.
Encrypt in your browser
Your secret is encrypted with AES-256-GCM using a key generated locally. The key lives in the URL fragment (the part after #), which browsers never send to the server.
Share the ash-bound link
We hand you a link like jivu.sh/s/abc…#your-key. Send it through any channel. The server only stored ciphertext + metadata. We can't decrypt it.
They read it. It turns to ash.
When the recipient opens the link and clicks Reveal, their browser fetches the ciphertext, decrypts it with the key from the fragment, and shows the secret. Then we burn it. Permanently.
Every secret is a tiny ceremony.
Built for builders, ops teams, and anyone who's shared a production key in plaintext and immediately regretted it.
Zero-knowledge by design
Keys never touch the server. The URL fragment carries the DEK, and browsers strip it before sending the request.
Burn after reading
One read and the ciphertext is physically removed from disk. The row remains for audit history, but the bytes are gone.
Bot-proof reveal
A pre-reveal interstitial stops Slack, WhatsApp, iMessage, Teams and Discord link-preview bots from burning your secret before a human ever clicks.
Receive Mode
Generate a request link, send it to a client, and they submit a secret back to you, encrypted in their browser using the same zero-knowledge method.
QR codes
Every share and request link comes with a scannable QR code for in-person handoff. Download it as a PNG in one click.
Recipient email OTP
Optionally require the recipient to verify their email with a one-time code before the secret is revealed. The link AND proof of who they are.
Collections & vaults
Bundle multiple secrets into one expiring share link. The recipient opens one URL and reveals each secret individually or all at once.
View limits & TTL
Set a precise number of reads and an expiry up to 90 days. After the limit or TTL, ciphertext is purged on next access.
Secret detection
As you type, a client-side scanner flags API keys (Stripe, AWS, GitHub, OpenAI), private keys, and connection strings, with a sensitivity score. Nothing leaves the browser.
Password-protected links
Wrap the DEK with a password using PBKDF2 (600k iterations, SHA-256). Recipient must enter the password to unwrap.
Encrypted file uploads
Send a file up to 25 MiB (Pro), encrypted end-to-end like text secrets. Recipient downloads a decrypted Blob.
Developer API
Use the REST API to create secrets programmatically. Pro+ accounts get API keys for automation and CI/CD pipelines.
See every view. Know every IP.
Each secret has an immutable audit log: created, viewed, burned. For every view we record the IP, user-agent, and referer. No content, ever. Just enough to know who looked.
Open dashboardcreated
2026-08-15 18:02 UTC
ip=73.4.12.99 · ua=Chrome · macOS
viewed
2026-08-15 18:09 UTC
ip=44.221.18.7 · ua=Safari · iOS
destroyed
2026-08-15 18:09 UTC
ip=44.221.18.7 · ua=Safari · iOS
Free forever. Upgrade when you ship.
Anonymous secrets are free forever. Pro unlocks custom slugs, scheduled release, and the developer API.
Free
For the occasional secret.
- ·10 anonymous secrets per day (fair-use)
- ·1-day TTL · burn-after-read
- ·5-view limit per link
- ·1 MiB text + file encryption
Pro
For builders who share constantly.
- ·Everything in Free
- ·90-day TTL · custom view limits
- ·25 MiB file encryption
- ·Custom branded slugs (jivu.sh/#/s/your-name)
Team
For teams who share as a craft.
- ·Everything in Pro
- ·5 seats included
- ·Shared branded link namespace
- ·Centralized audit + billing
Questions, answered.
Can the server read my secret?+
No. The encryption key is generated in your browser and lives in the URL fragment (the part after #), which browsers never send in HTTP requests. The server only ever stores ciphertext + IV + metadata. We literally could not read your secret even if we wanted to.
What does “burn after reading” mean?+
When the recipient opens the link, the browser fetches the ciphertext and decrypts it locally. As soon as that happens, the server physically removes the ciphertext from disk (sets the column to NULL). The row stays for audit history, but the bytes are gone. The link will never resolve again.
How do password-protected links work?+
If you set a password, we wrap the DEK with a key derived from the password using PBKDF2 (600,000 iterations of SHA-256). The wrapped DEK + salt + iteration count are sent to the server. The recipient must enter the password to unwrap the DEK locally. The password itself never leaves their browser.
What happens when a secret expires?+
If the TTL passes before anyone opens the link, the next person to visit it triggers a lazy expiry: the server destroys the ciphertext (sets to NULL), marks the row as destroyed with reason “expired”, and returns the destroyed state. No content is revealed.
Can I revoke a link I created?+
Yes. Every secret returns a one-time creator token at creation. With it, you can DELETE /api/secrets/{id}?creatorToken=… to instantly revoke the link. The ciphertext is removed from disk immediately. Authed (Pro+) users can also revoke from the dashboard.
Is the free tier really free?+
Yes. Anonymous secrets are free forever, with no email required and no credit card. Free tier limits: 1-day TTL, max 5 views per link, 1 MiB ciphertext, 10 secrets per IP per day (fair-use). Upgrade to Pro for 90-day TTL, 25 MiB files, custom slugs, scheduled release, and the developer API.
Even we can't read it.
And after they do, it's gone.
The zero-knowledge design means trust is structural. We couldn't read your secret if we wanted to. The key is in the URL fragment, and browsers never send that to the server. That's the promise. That's the product.
Share your first secret