BurnLink is a free, no-registration web tool that lets you share sensitive information — passwords, API keys, private messages, credentials — via a single-use encrypted link that permanently self-destructs after being opened. No apps to download, no account required.

Yes. BurnLink uses AES-256-GCM encryption (the highest commercially available standard), stores only encrypted ciphertext, and permanently deletes all data the moment a secret is accessed. The server is architecturally incapable of reading your messages. All data in transit is protected by TLS 1.3. See burnlink.cc/security for the full technical breakdown.

How does the self-destructing message work?

When you create a secret, BurnLink encrypts it with AES-256-GCM and stores only the encrypted payload. Once the recipient opens the link and reveals the message, it is immediately and permanently deleted from all servers — including backups. There is no way to recover it.

What encryption does BurnLink use?

BurnLink uses AES-256-GCM (Advanced Encryption Standard, 256-bit, Galois/Counter Mode) — the same standard used by NATO for Top Secret classification, the NSA, and FIPS 197. All data in transit is protected by TLS 1.3 with forward secrecy.

How can I send a password securely to someone?

Use BurnLink: paste the password, click "Create secure link", and send the link. It is encrypted and self-destructs after being opened once, so even if later found in an email or chat log, it will be dead and contain nothing.

Does BurnLink store my messages?

BurnLink stores only the encrypted payload, temporarily, until it is read. The plaintext is never stored or logged. Once burned, all data is permanently deleted. There is no archive or backup of message content.

Do I need an account to use BurnLink?

No. BurnLink requires no account, no email address, and no sign-up of any kind. It is completely anonymous and free.

Is BurnLink a good Privnote alternative?

Yes. BurnLink offers the same burn-after-reading concept as Privnote with stronger, explicitly specified AES-256-GCM encryption, optional passphrase protection, configurable view limits, and a modern mobile-friendly interface.

Can law enforcement access my BurnLink messages?

No. BurnLink stores only encrypted payloads and deletes all data upon access. There is nothing to produce in response to a subpoena or court order. Burned messages are irrecoverably gone from all infrastructure.

Can I share API keys securely with BurnLink?

Yes. BurnLink is widely used by developers and IT teams to securely share API keys, private keys, access tokens, database credentials, and SSH passwords. The one-time link model ensures credentials cannot be intercepted after delivery.

What is zero-knowledge encryption?

Zero-knowledge means the server never has access to the plaintext content. Only encrypted ciphertext is stored. BurnLink uses zero-knowledge architecture — even BurnLink staff cannot read your secrets.

Yes. BurnLink is completely free with no usage limits, no ads, and no premium tier. No credit card or account is ever required.

How is BurnLink different from email?

Email stores messages permanently on servers. BurnLink creates a one-time anonymous link that self-destructs on access. There is no message to find in an inbox, no forwarding risk, and no stored history.

How long does BurnLink keep my secret?

Until it is viewed (default: 1 view). You can also set a custom expiry time or higher view limit. Once the limit or expiry is hit, the secret is permanently deleted.

Can I add a password to my secret link?

Yes. You can add an optional passphrase. The recipient must enter the correct passphrase before the message is revealed, adding an extra layer of security beyond just having the link.

Is BurnLink safe to use?

Yes. BurnLink uses AES-256-GCM encryption, stores only encrypted payloads (never plaintext), and permanently deletes all data the moment a secret is accessed. The server is architecturally incapable of reading your messages. All data in transit is protected by TLS 1.3.

What encryption does BurnLink use?

BurnLink uses AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode). This is an authenticated encryption algorithm that provides both confidentiality and integrity. It is the same standard used by NATO for Top Secret classification, the NSA, and leading financial institutions worldwide.

What is zero-knowledge encryption?

Zero-knowledge means the server never has access to the plaintext content of your secret. Only the encrypted payload is stored. BurnLink staff, the hosting provider, and any third party with server access cannot read your messages — not because of policy alone, but because the architecture prevents it.

Can BurnLink be hacked to reveal my secrets?

Even if an attacker gained full access to BurnLink servers, they would find only AES-256-GCM encrypted ciphertext — not readable content. Brute-forcing AES-256 would take longer than the age of the universe with current or foreseeable computing technology. Additionally, secrets are deleted immediately after access, so the attack window is extremely narrow.

Security

Is BurnLink safe?
Yes. Here is exactly why.

Full technical breakdown of how BurnLink encrypts, stores, and permanently destroys your secrets. No vague promises — just the architecture.

AES-256-GCMEncryption standard

Zero-knowledgeArchitecture

TLS 1.3In transit

Zero logsPolicy

Instant deleteOn access

Encryption specification

Algorithm

AES-256-GCM

Advanced Encryption Standard, 256-bit, Galois/Counter Mode

Key size

256 bits

2²⁵⁶ possible keys — computationally infeasible to brute-force

Mode

GCM (authenticated)

Provides both confidentiality AND integrity verification

Transport layer

TLS 1.3

With forward secrecy — past sessions stay safe if keys are compromised

Cipher suite

TLS_AES_256_GCM_SHA384

At-rest storage

Ciphertext only

Plaintext is never written to any disk or log

Used by

NATO, NSA, AES standard

Same spec as Top Secret US government data

Zero-knowledge architecture

“Zero-knowledge” means the server is structurally incapable of reading your message — not just by policy, but by design. Here is the full data flow:

You write your secret

Your message exists only in your browser at this point. Nothing is sent yet.

Encryption happens

BurnLink encrypts the content with AES-256-GCM. The plaintext is immediately discarded.

Only ciphertext is stored

The encrypted payload is sent to the server and stored. The server never receives or sees the plaintext at any point.

Recipient opens the link

The server retrieves the ciphertext and serves it. The decryption key is part of the URL — the server processes it but only the client renders the plaintext.

Immediate permanent deletion

The moment the secret is accessed, the ciphertext is permanently deleted from the database and all backups. The link is now dead.

Data lifecycle & zero-logs policy

What we store

Encrypted ciphertext (AES-256-GCM)

View limit setting

Expiry timestamp

Whether a passphrase is set

Creator IP (abuse prevention)

Creation timestamp

What we never store

Plaintext message content

Names or email addresses

Who received a secret

Reading history or analytics

Cookies or persistent identifiers

Advertising or tracking data

Deletion is immediate and irreversible. Upon access (or expiry / view limit), all stored data for a secret — ciphertext, metadata, IP, timestamps — is permanently deleted in a single atomic operation. There is no soft-delete, no archive, no cold storage, no backups that survive past the secret's TTL.

Threat model

Honest security means acknowledging what BurnLink protects against — and what it does not.

Network interception (MITM)

TLS 1.3 with forward secrecy — intercepted traffic is unreadable

Server breach / data leak

Only AES-256-GCM ciphertext stored — plaintext never written to disk

Replay attacks (link reuse)

One-time link model — secret is deleted immediately after first access

Government / law enforcement request

Burned secrets are irrecoverably gone — nothing to produce

Brute-force decryption

AES-256 key space is 2¹²⁵ times larger than 128-bit — computationally infeasible

Passphrase theft (link + passphrase)

Optional passphrase adds a second factor — attacker needs both link AND passphrase

Recipient screenshots or copies

Out of scope — BurnLink controls the link, not the recipient's device

Phishing (fake BurnLink site)

Always verify you are on burnlink.cc — check the HTTPS padlock

● Mitigated by BurnLink · ●Out of BurnLink's control — user responsibility

Standards & compliance posture

FIPS 197

AES is a FIPS 197-certified standard — used for US federal government data protection.

GDPR-aligned

No personal data is stored beyond the minimum required for operation, and it is auto-deleted.

CCPA-aligned

BurnLink does not sell or share personal data. Zero third-party advertising trackers.

RFC 5116 (AEAD)

AES-GCM is an authenticated encryption scheme per RFC 5116 — provides integrity in addition to confidentiality.

NIST SP 800-38D

NIST recommendation for GCM mode — BurnLink follows the published recommendation for nonce and tag handling.

Subpoena-resistant

Burned secrets are irrecoverably deleted. There is no data to produce in response to legal process targeting message content.

Responsible disclosure

If you discover a security vulnerability in BurnLink, we ask that you disclose it to us privately before publishing publicly. This gives us time to investigate and address the issue without putting users at risk.

We commit to: (1) acknowledging your report within 72 hours, (2) keeping you informed of our progress, and (3) publicly crediting researchers who report valid vulnerabilities (if they wish). We will not pursue legal action against good-faith security researchers.

Ready to send a secret securely?

AES-256-GCM. Zero-knowledge. Self-destructs on read. Free forever.

Create a secure link