How dw Secret Notes works

What happens when you create, share and read a secret message, and where the limits are. Knowing how a tool works helps you decide what to use it for.

1. Encrypted in your browser

When you create the link, encryption runs on your device. A random secret is created, a 256-bit key is derived with PBKDF2 (SHA-256, 100,000 rounds), and text and optional image are encrypted with AES-GCM using fresh random initialization vectors. A wrong key or changed data makes decryption fail instead of showing wrong text.

2. What the server stores

Only the encrypted content with a message ID. The plaintext does not leave your device. Unknown IDs get a neutral "not found" answer, so existing messages cannot be found by guessing.

3. The link

The link holds the message ID and the secret for the key. Whoever has the full link can read the message once, so treat it like a password and send it only to the intended person.

4. Reading and deleting

The recipient opens the link or pastes it into the Decrypt tab. The content is fetched, decrypted locally and then deleted from the server. A 60-second countdown runs while the message is visible, then the content is hidden.

Honest limits

• The link is the key. If it is intercepted before the recipient opens it, a third party could read first. The recipient notices because the note is already gone.
• No identity check. The method does not verify who opens the link.
• Screenshots and photos of the screen cannot be prevented.
• Clean devices needed. Malware on either device can read input and display.
• Deleted means deleted from the server, not from the recipient's memory or notes.

What it is good for

One-time hand-overs such as a Wi-Fi password, an access code or a screenshot that should not stay in a chat or inbox. For permanent team access, a password manager with sharing is the better choice. More in the blog and in Help and FAQ. More programs: tools-for-you.de.