Encrypted · Self-destructing
Send a secure message.
It reads once, then disappears.
Write your message. Get a link. Send it anywhere. The recipient reads it once — and it's gone, with no trace in chat logs or server backups.
Your link — copied to your clipboard
Anyone with this link can read the note until it's destroyed. The key after the # never reaches our server.
Free, no sign-up. Need a password or a longer life? More options
Where most secure messages aren't
Every channel you use for sensitive messages stores a copy — on their servers, on your device, in search indexes. "Secure" usually means encrypted in transit, not encrypted at rest, and certainly not destroyed after reading.
Slack / Teams
Stored indefinitely in workspace history. Admins can read any message. Searchable across the organisation.
Copies live in sent folder, inbox, and all synced devices. Email servers store messages for years.
Signal
End-to-end encrypted, but messages persist on both devices. Backups, linked devices, and screenshots create copies.
Backed up to iCloud or Google Drive — often unencrypted. Disappearing messages are not zero-knowledge.
iMessage
iCloud backups may include message history in plaintext. Shared across all Apple devices signed in to the same account.
Telegram
Cloud chats are stored on Telegram servers in plaintext. Only 'Secret Chats' are E2E encrypted — and those still persist on devices.
How a self-destructing message works
- 1
Write your message
Any text — a private note, a password, legal information, personal details. Optionally set a view limit (up to 10 without an account, 100 with a free one) and a password the recipient will also need.
- 2
Encrypted before it leaves your browser
AES-256-GCM encryption runs locally. A random decryption key is generated and put in the link, after the #, which browsers never send to the server. VoidNote's server stores only ciphertext.
- 3
Share the link — via any channel
Send the link over email, Slack, WhatsApp, SMS — anywhere. Treat the link like the secret: it contains the reference to the encrypted note and the decryption key.
- 4
The message self-destructs on read
The recipient's browser decrypts the message locally. On the last allowed view the server deletes the encrypted record. The link stops working. No transcript, no log, no recovery.
Two-channel security with a password
Set a password on your message — the recipient needs both the link and the password. Share the link over one channel (email, Slack) and the password over another (phone call, in person). An attacker who intercepts the link cannot read the message without the password. This is the recommended pattern for anything highly sensitive.
Signal vs VoidNote — which to use
These tools solve different problems. Signal is excellent for ongoing private conversations. VoidNote is for one-shot secrets that must not persist anywhere.
Use Signal when…
- ·You need an ongoing private conversation
- ·You want voice or video calling
- ·The recipient is a known contact
- ·You need message history
Use VoidNote when…
- ·You're sharing a password or secret
- ·The message must not persist anywhere
- ·The recipient doesn't have Signal
- ·You need proof the message self-destructed
Common questions
Does the recipient need an account or app?
No. The recipient just needs a browser. They click the link, optionally enter a password, and read the message — no registration, no app install. The link works on any device.
What if the message is sensitive enough that I don't trust any link?
Set a password on the note and share it via a fully out-of-band channel (in person or by phone). The link alone is useless without the password — an intercepted link reveals nothing.
How long does the link stay active?
Until the expiry you choose or until the view count reaches zero, whichever comes first. Expiry can be up to 7 days without an account, or 30 days with a free one.
Can I send long messages?
Yes — a note can hold roughly 750 KB of text. For documents and other files, use the Vault (free with an account), which encrypts and delivers files via a single-use download link.
Send a message that actually disappears
No account needed. Works in any browser. Zero plaintext stored — ever.