Paste the note below — encrypted in this tab, delivered by a one-time link or QR, gone in 10 minutes.
Scan this on the other device:
The key exists only in this link — we never receive it and cannot bring it back.
Got a code? Fetch it here:
Whichever service you pick — this one included — hold it to four
things. The note should be encrypted in your browser, with the key
in the part of the link after the #, so the server only ever
stores ciphertext. The pages where the note is written and read should
load no outside scripts — no ads, no analytics, no CDN code — because any
loaded script runs right next to your secret. «Deleted after reading»
should mean deleted, not archived. And you should be able to read the
source code rather than take anyone's word for all of the above. The best
Privnote alternative is whichever service passes all four — hold this one
to them too.
Notes are encrypted on this page with AES-256-GCM and the server holds ciphertext only; the key never reaches us. The compose and read pages load zero network scripts — not even our own visit counter — and the page's security policy has the browser enforce that, rather than politely promising it. Notes live in memory only, die on first read or after 10 minutes, and are never written to disk. The full source is public, at github.com/delawer33/throw.dog.
Two things you won't find in most Privnote-style services. The QR: the result card leads with one, so you can hand a secret to the person next to you without the link — and its key — ever entering a chat history. And the 10-minute lifetime: most services keep an unread note for days or weeks; here it's gone in 10 minutes, because a live secret link with a long shelf life is mostly a liability with a countdown nobody is watching.
In-browser encryption — anyone's — can't protect you from the site that serves the encrypting page itself; we say so in our Privacy note rather than hide behind the word «encrypted». Notes are text up to 64 KB; files aren't here yet.