Frequently Asked Questions

BurnLink is a free, no-registration web tool that lets you share sensitive information — passwords, API keys, private messages, credentials — via a single-use encrypted link. Once the recipient opens the link, it is permanently and irrecoverably destroyed. No traces. No backups.

BurnLink is used by developers sharing API keys and SSH passwords, IT teams delivering credentials, HR professionals sending confidential documents, legal teams sharing privileged information, and anyone who needs to send sensitive data without leaving a permanent record.

Yes. BurnLink is completely free — no account, no credit card, no premium tier, no usage limits. It is free to use forever.

No app download or account is required. BurnLink works entirely in your browser. Open the website, write your secret, get a link, share it. That is it.

BurnLink uses AES-256-GCM — the same encryption standard used by NATO, the NSA for Top Secret classification, and the world's leading banks. It is the highest commercially available encryption standard. All data in transit is additionally protected by TLS 1.3 with forward secrecy.

Yes. BurnLink encrypts your message before it is stored. The plaintext content is never written to disk or logs at any point. Only the encrypted payload is stored, and it is deleted immediately after being accessed.

No. BurnLink operates a zero-knowledge architecture. We store only the encrypted payload and are structurally incapable of reading your secrets. Even our own staff cannot read your message.

No. Because BurnLink stores only encrypted payloads and deletes all data upon access, there is nothing to produce in response to a subpoena or court order. Burned messages are irrecoverably gone from all infrastructure, including backups.

Yes. BurnLink is specifically designed for this use case. The AES-256-GCM encryption and one-time link model mean your credentials are protected in transit and self-destruct after delivery. It is significantly safer than sending passwords via email, SMS, or chat.

When you create a secret, BurnLink encrypts it and stores the encrypted payload. When the recipient opens the link and reveals the message, BurnLink immediately and permanently deletes the encrypted payload from all servers. The link becomes invalid and returns a burned notice. No one can access the content again.

Yes. By default, links can be opened once (1 view). You can set a custom view limit of up to 100 views if you need to share the same secret with multiple people. After the limit is reached, the link is burned.

Yes. You can set a custom expiry date and time. Once the expiry is reached, the secret is permanently deleted — even if it has never been opened. This gives you control over how long your secret exists.

They will see a "This message has been burned" notice. No content is displayed or retrievable, not even by BurnLink staff.

If the link fails to load (returns burned), you know it was opened. By default, BurnLink does not send read receipts, which protects recipient privacy. The burn itself is the confirmation.

BurnLink keeps no logs of secret content. Operational metadata (IP address, user-agent, timestamp) is stored temporarily for abuse prevention and is purged when the secret is deleted. We do not log what you type or who receives your message.

BurnLink does not use advertising cookies or cross-site tracking. Basic session functionality may use a cookie for UI preferences (e.g., dark mode), but no third-party advertising or analytics trackers are embedded.

The link itself is useless without the key embedded in the URL fragment. The content is encrypted with AES-256-GCM. Even if someone intercepts the link before you share it, they cannot read the message without both the link and the decryption key. Adding a passphrase gives a further layer of protection.

BurnLink stores: (1) the encrypted secret payload, (2) the view limit setting, (3) the expiry timestamp, (4) whether a passphrase is set (not the passphrase itself), (5) the creator's IP address for abuse prevention. All of this is deleted when the secret is burned.

The safest way is to use BurnLink. Paste the password, get an encrypted one-time link, send it via any channel. Even if the link is later discovered in an email thread or chat log, it will be expired and contain nothing. Far safer than sending passwords in plain text.

Yes. BurnLink is widely used by developers to share API keys, private keys, access tokens, and SSH passwords. The one-time link ensures credentials cannot be re-accessed after delivery.

Yes. HR and IT teams use BurnLink to deliver initial credentials to new employees. The one-time link model ensures credentials are not left floating in email inboxes permanently.

Yes. In Advanced Options, you can add a passphrase. The recipient must enter the correct passphrase before the message is revealed. This is useful if you are sending the link over an insecure channel and want a second authentication factor.

BurnLink offers the same burn-after-reading concept as Privnote but with explicitly documented AES-256-GCM encryption, modern mobile-friendly design, optional passphrase protection, configurable view limits, and a strict zero-logs policy. BurnLink also works with no account or sign-up.

Signal and WhatsApp require both parties to have the app installed and an account. BurnLink works with nothing — no app, no account. You create a link and send it via any channel. The message exists only until it is read, then it is gone entirely. BurnLink is purpose-built for one-time sensitive disclosures, not ongoing conversations.

Yes. BurnLink is a strong Privnote alternative. It offers self-destructing encrypted links with stronger explicitly-stated encryption (AES-256-GCM), optional passphrase, configurable view limits, and a modern interface.

Yes. Like OneTimeSecret, BurnLink creates one-time encrypted links for sensitive data. BurnLink offers a more modern interface, passphrase protection, configurable view limits, and is completely free with no account required.

Yes. BurnLink works entirely in the browser — no app, no install, no account. Just open the website, write your message, and get a self-destructing link.