Paste the password below — it is encrypted right here in your browser, and you get a one-time link and QR to hand over.
Scan this on the other device:
The key exists only in this link — we never receive it and cannot bring it back.
Got a code? Fetch it here:
A password dropped into chat or email stays there: in both histories, in both backups, on however many devices those accounts are signed into, for years. The link this page gives you works exactly once and stops existing after 10 minutes either way — so what's left in the chat afterwards is a dead link, not the password. Free, online, no account on either end.
Your browser encrypts the password on this page with AES-256-GCM before
anything is sent. The decryption key travels only in the part of the link
after the #, which browsers never send to any server — so the
server holds ciphertext it cannot read, and neither can we. This page also
loads no script from the network, not even our own analytics, so every
line of code that touches your secret arrived in this one document.
The first time the link is opened, the throw is handed out and destroyed — even if the opener's key turns out wrong. We can't tell whether decryption succeeded on their side, and waiting to be told would be a way to make one secret readable twice. If the link is lost, nothing is recoverable, by anyone, including us. That's the deal, stated up front.
Use the QR instead of the link: the other person scans it from your screen, and the key never enters any chat at all.