BurnLink is a free, no-registration web tool that lets you share sensitive information — passwords, API keys, private messages, credentials — via a single-use encrypted link that permanently self-destructs after being opened. No apps to download, no account required.

Yes. BurnLink uses AES-256-GCM encryption (the highest commercially available standard), stores only encrypted ciphertext, and permanently deletes all data the moment a secret is accessed. The server is architecturally incapable of reading your messages. All data in transit is protected by TLS 1.3. See burnlink.cc/security for the full technical breakdown.

How does the self-destructing message work?

When you create a secret, BurnLink encrypts it with AES-256-GCM and stores only the encrypted payload. Once the recipient opens the link and reveals the message, it is immediately and permanently deleted from all servers — including backups. There is no way to recover it.

What encryption does BurnLink use?

BurnLink uses AES-256-GCM (Advanced Encryption Standard, 256-bit, Galois/Counter Mode) — the same standard used by NATO for Top Secret classification, the NSA, and FIPS 197. All data in transit is protected by TLS 1.3 with forward secrecy.

How can I send a password securely to someone?

Use BurnLink: paste the password, click "Create secure link", and send the link. It is encrypted and self-destructs after being opened once, so even if later found in an email or chat log, it will be dead and contain nothing.

Does BurnLink store my messages?

BurnLink stores only the encrypted payload, temporarily, until it is read. The plaintext is never stored or logged. Once burned, all data is permanently deleted. There is no archive or backup of message content.

Do I need an account to use BurnLink?

No. BurnLink requires no account, no email address, and no sign-up of any kind. It is completely anonymous and free.

Is BurnLink a good Privnote alternative?

Yes. BurnLink offers the same burn-after-reading concept as Privnote with stronger, explicitly specified AES-256-GCM encryption, optional passphrase protection, configurable view limits, and a modern mobile-friendly interface.

Can law enforcement access my BurnLink messages?

No. BurnLink stores only encrypted payloads and deletes all data upon access. There is nothing to produce in response to a subpoena or court order. Burned messages are irrecoverably gone from all infrastructure.

Can I share API keys securely with BurnLink?

Yes. BurnLink is widely used by developers and IT teams to securely share API keys, private keys, access tokens, database credentials, and SSH passwords. The one-time link model ensures credentials cannot be intercepted after delivery.

What is zero-knowledge encryption?

Zero-knowledge means the server never has access to the plaintext content. Only encrypted ciphertext is stored. BurnLink uses zero-knowledge architecture — even BurnLink staff cannot read your secrets.

Yes. BurnLink is completely free with no usage limits, no ads, and no premium tier. No credit card or account is ever required.

How is BurnLink different from email?

Email stores messages permanently on servers. BurnLink creates a one-time anonymous link that self-destructs on access. There is no message to find in an inbox, no forwarding risk, and no stored history.

How long does BurnLink keep my secret?

Until it is viewed (default: 1 view). You can also set a custom expiry time or higher view limit. Once the limit or expiry is hit, the secret is permanently deleted.

Can I add a password to my secret link?

Yes. You can add an optional passphrase. The recipient must enter the correct passphrase before the message is revealed, adding an extra layer of security beyond just having the link.

BurnLink Back

Legal

Privacy Policy

Effective date: June 29, 2026 · BurnLink

BurnLink is built on a single principle: your secrets are not our business. This policy explains, in plain language, exactly what we collect, what we do not collect, and how your data is protected. It is intentionally brief because our data practices are intentionally minimal.

1. Encryption & Security

All message content is protected with AES-256-GCM — the same cipher standard used by NATO, the NSA for Top Secret classification, and leading financial institutions. This is the highest commercially available encryption standard in existence.

All data in transit is protected by TLS 1.3 with forward secrecy. Communications cannot be intercepted or retroactively decrypted even if future keys are compromised.

Secrets are stored encrypted at rest. Once a secret reaches its view limit or expiry, it is permanently and irrecoverably deleted from our infrastructure — including all backups within the same TTL cycle.

2. No-Logs Policy

BurnLink operates a strict zero-logs policy with respect to secret content. Specifically, we do not log, store, or transmit:

The plaintext content of any message
Who sent a secret to whom
The identity of message recipients
Reading history or access patterns linked to individuals
Any data that could be used to reconstruct a secret after it is burned

Once a secret is burned, its content is gone. We cannot recover it, and no third party — including law enforcement — can compel us to produce data we do not possess.

3. Data We Collect

To operate the service, we temporarily process the following operational metadata only:

Secret metadata — view limit, expiry timestamp, whether a passphrase is set. Never the content itself.
IP addresses — recorded at creation and access time solely for abuse prevention and rate-limiting. Not linked to identity. Purged when the secret is destroyed.
User-agent strings — browser or device type, used for security analytics only.
Timestamps — when a secret was created and when it was accessed, retained only while the secret exists.

We do not collect names, email addresses, phone numbers, account data, cookies, or any form of persistent identifier unless you voluntarily contact us.

4. Data Retention & Deletion

Secrets are auto-deleted upon the earliest of: (a) reaching the configured view limit, (b) reaching the configured expiry time, or (c) manual deletion by the creator.

Associated metadata (IP, user-agent, timestamps) is deleted in the same operation. There is no archive, no cold storage, no soft-delete. Deletion is final, immediate, and irreversible.

5. Third Parties & Disclosure

We do not sell, rent, trade, or share your data with third parties for commercial purposes. Ever.

We may share aggregated, fully anonymised statistical data (e.g. “N secrets were created this month”) that contains no personal information whatsoever.

In the event of a lawful government request: because we hold no content and no persistent personal data, there is nothing to disclose. We are structurally incapable of cooperating with surveillance requests that target message content.

6. Contact

Questions about this policy or your data may be directed to the BurnLink team. As we collect no personal data, there is typically no “your data” to action — but we are happy to clarify anything.

We reserve the right to update this policy. Material changes will be reflected by an updated effective date above. Continued use of BurnLink after changes constitutes acceptance of the revised policy.