Free forever. Upgrade when you ship.
Anonymous secrets are free forever. Pro unlocks custom slugs, scheduled release, and the developer API.
Questions, answered.
Can the server read my secret?+
No. The encryption key is generated in your browser and lives in the URL fragment (the part after #), which browsers never send in HTTP requests. The server only ever stores ciphertext + IV + metadata. We literally could not read your secret even if we wanted to.
What does “burn after reading” mean?+
When the recipient opens the link, the browser fetches the ciphertext and decrypts it locally. As soon as that happens, the server physically removes the ciphertext from disk (sets the column to NULL). The row stays for audit history, but the bytes are gone. The link will never resolve again.
How do password-protected links work?+
If you set a password, we wrap the DEK with a key derived from the password using PBKDF2 (600,000 iterations of SHA-256). The wrapped DEK + salt + iteration count are sent to the server. The recipient must enter the password to unwrap the DEK locally. The password itself never leaves their browser.
What happens when a secret expires?+
If the TTL passes before anyone opens the link, the next person to visit it triggers a lazy expiry: the server destroys the ciphertext (sets to NULL), marks the row as destroyed with reason “expired”, and returns the destroyed state. No content is revealed.
Can I revoke a link I created?+
Yes. Every secret returns a one-time creator token at creation. With it, you can DELETE /api/secrets/{id}?creatorToken=… to instantly revoke the link. The ciphertext is removed from disk immediately. Authed (Pro+) users can also revoke from the dashboard.
Is the free tier really free?+
Yes. Anonymous secrets are free forever, with no email required and no credit card. Free tier limits: 1-day TTL, max 5 views per link, 1 MiB ciphertext, 10 secrets per IP per day (fair-use). Upgrade to Pro for 90-day TTL, 25 MiB files, custom slugs, scheduled release, and the developer API.