The latest articles on DEV Community by special agent (@specialagentbreadwinner). https://dev.to/specialagentbreadwinner https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4087211%2F4ee11779-67f4-4a7b-9e08-259f46c91d34.png https://dev.to/specialagentbreadwinner en special agent Thu, 20 Aug 2026 21:21:20 +0000 https://dev.to/specialagentbreadwinner/why-i-built-a-zero-knowledge-client-side-encrypted-burning-note-app-over-the-weekend-bal https://dev.to/specialagentbreadwinner/why-i-built-a-zero-knowledge-client-side-encrypted-burning-note-app-over-the-weekend-bal <p>Hey everyone! 👋</p> <p>Like many developers and sysadmins, I constantly find myself needing to share temporary credentials, API keys, or sensitive text with clients and coworkers. Dropping these straight into Slack, Discord, or standard email always feels like a massive security headache because those chat platforms store everything in plain text in their databases.</p> <p>I looked into popular "one-time secret" web utilities, but I noticed a major flaw: almost all of them handle the encryption and decryption on their servers. That means you have to blindly trust their backend configurations, logging policies, and database security. </p> <p>I wanted something truly zero-knowledge where the server owner physically couldn't read the notes even if they wanted to. So, I built <strong>ScorchNote</strong>: <a href="https://scorchnote.com" rel="noopener noreferrer">https://scorchnote.com</a></p> <h3> 🛠️ How it Works (Under the Hood) </h3> <p>To achieve absolute zero-knowledge, ScorchNote relies on strict client-side mechanics:</p> <ol> <li> <strong>Browser-Side Encryption:</strong> When you type a secret, the data is encrypted directly in your browser before it ever leaves your network interface. </li> <li> <strong>The URL Hash Advantage:</strong> The decryption key is generated and stored inside the URL's hash fragment (everything after the <code>#</code>). </li> <li> <strong>Zero Server Footprint:</strong> Web browsers never send the hash fragment to the host server during HTTP requests. This means my database only receives a completely scrambled, encrypted payload. The server has no concept of what the key is.</li> <li> <strong>Millisecond Burn-on-Read:</strong> The moment the recipient visits the link, the encrypted payload is fetched and instantly purged from the server database. </li> </ol> <h3> 🚀 Try It Out </h3> <p>I kept the page entirely lightweight, minimalist, and completely free of bloated tracking scripts. It’s built to do exactly one job, safely and instantly.</p> <p>I would love to hear your thoughts on the architecture, the user experience, or what features you think I should cook up next!</p> <p>Check it out here: <a href="https://scorchnote.com" rel="noopener noreferrer">ScorchNote</a></p> webdev privacy security javascript