This note can only be read once. Open it now?

Once opened, it is deleted from the server and cannot be viewed again.

Notes are encrypted in your browser before they leave it. The key lives only in the link fragment, after the #, which your browser never sends to the server. The server stores only ciphertext and deletes it the first time the note is read.

1. Encrypt. A random 256-bit key is generated in your browser. The note is encrypted with AES-256-GCM (key derived via HKDF-SHA256; your password, if set, is mixed in).
2. Store. Only the ciphertext goes to the server, into Cloudflare KV with your chosen expiry.
3. Share. The link carries the key in its fragment (#…). Fragments are never sent in HTTP requests, so the server never sees it.
4. Read once. The first request for the note returns the ciphertext and deletes it in the same operation. Decryption happens on the reader's device.