Hey everyone! 👋
Like many developers and sysadmins, I constantly find myself needing to share temporary credentials, API keys, or sensitive text with clients and coworkers. Dropping these straight into Slack, Discord, or standard email always feels like a massive security headache because those chat platforms store everything in plain text in their databases.
I looked into popular "one-time secret" web utilities, but I noticed a major flaw: almost all of them handle the encryption and decryption on their servers. That means you have to blindly trust their backend configurations, logging policies, and database security.
I wanted something truly zero-knowledge where the server owner physically couldn't read the notes even if they wanted to. So, I built ScorchNote: https://scorchnote.com
🛠️ How it Works (Under the Hood)
To achieve absolute zero-knowledge, ScorchNote relies on strict client-side mechanics:
- Browser-Side Encryption: When you type a secret, the data is encrypted directly in your browser before it ever leaves your network interface.
-
The URL Hash Advantage: The decryption key is generated and stored inside the URL's hash fragment (everything after the
#). - Zero Server Footprint: Web browsers never send the hash fragment to the host server during HTTP requests. This means my database only receives a completely scrambled, encrypted payload. The server has no concept of what the key is.
- Millisecond Burn-on-Read: The moment the recipient visits the link, the encrypted payload is fetched and instantly purged from the server database.
🚀 Try It Out
I kept the page entirely lightweight, minimalist, and completely free of bloated tracking scripts. It’s built to do exactly one job, safely and instantly.
I would love to hear your thoughts on the architecture, the user experience, or what features you think I should cook up next!
Check it out here: ScorchNote
Top comments (0)