How Vanishnote works
The short version: your browser locks the note, the only key rides in the link, and we only ever hold a locked box we have no way to open.
1. Your browser encrypts the note
When you press Create secure link, your browser generates a brand-new random 256-bit key and encrypts your note with AES-256-GCM using the Web Crypto API built into every modern browser. No plugins, no third-party libraries. The original text never leaves your device.
2. We store only the locked version
Your browser sends us the encrypted bytes plus the settings you chose: when it should expire and how many times it can be opened. We save that, give it a random 128-bit ID, and send the ID back. We never receive the key.
3. The key travels in the link, after the #
https://vanishnote.example/n/3q2-7wLk0aZb1xYcPn8T4g#Vx4mP9qL2rT8wZ0kB5nH7cJ3fD6sA1yE
- The address
- Sent to our server so it can find the locked note. On its own it unlocks nothing.
- The key, after the #
- Made in your browser. Browsers never send this part to a server, so it goes from you to your recipient and never reaches us.
Everything after the # is called the fragment. Browsers keep the fragment to themselves: it's not included when the page is requested from our server, so the key goes from your device to your recipient's without passing through us. Without it, what we store is just scrambled data.
4. Opening the link doesn't burn the note. Pressing Reveal does.
Messaging apps often fetch links to build a preview, and that would destroy a note before the real recipient sees it. So opening a Vanishnote link only shows a "Reveal note" button. The note is retrieved, and deleted from our database, only when a person presses it.
Deletion happens in the same database operation that hands over the note, so even if two people press Reveal at the same instant, only one of them gets it.
5. The recipient's browser decrypts it
Your recipient's browser takes the key from the link and decrypts the note locally. If it was a single-view note, it no longer exists anywhere except on their screen.
Optional extras
- Password. Your password is stretched with 600,000 rounds of PBKDF2 and combined with the link key. Both are needed to decrypt. We never receive the password or anything that would let us check guesses.
- Multiple views. Allow up to 10 views. Each Reveal uses one up; the last one deletes the note.
- Expiry. Unread notes are deleted after 1 hour, 1 day or 7 days. With an account you can also shred a note after a set time, up to 12 months on paid plans.
- Read notification. We can email you when the note is opened. Your address is stored only until the note is deleted.
- Destroy link. You get a private link to delete the note early if you change your mind.
Want the technical details and the limits of what this protects against? Read our security model.