Free on the App Store, Google Play & F-Droid

Notes that burn after reading.

BurnPony seals a note on your phone with AES-256-GCM, hands you one link, and steps out of the way. The recipient opens it in any browser — no app, no account — and after the last allowed view the note is gone. The server in the middle only ever holds ciphertext.

AES-256-GCM sealed on your device no account · app for recipients · analytics 1–100 views, then ash
YOU SERVER · CIPHERTEXT ANY BROWSER key stays in the #fragment

Sealed on your phone. Burned after they read.

// get it

Free on the App Store, Google Play, and F-Droid.

Nothing to sign up for, nothing to configure. Install it, write a note, share the link.

iOS available now

BurnPony is free for iPhone. Download it on the App Store.

Android available now

Free on Google Play and F-Droid. Get it on Google Play or get it on F-Droid.

Desktop available now

macOS, Linux, and Windows builds, signed and checksummed. See the downloads.

Any browser no install

Recipients never need an app. A note is one link that decrypts in any modern browser, on any platform.

// how it works

Write it. Link it. Watch it burn.

The whole product is three steps, and the encryption happens before step two.

01

Write and seal

Type the note on your phone. Before anything is uploaded, it's encrypted on the device with AES-256-GCM — the key is derived from 32 fresh random bytes, and those bytes never leave your phone in any request.

02

Share one link

You get a single link with the decryption key tucked into its #fragment — the part browsers keep to themselves. Send it over any channel, or let the recipient scan the QR code in person. Want a second factor? Add a passphrase and share it separately.

03

It burns

The recipient taps Reveal in any modern browser and the note decrypts right there. On the last allowed view, the server deletes the ciphertext in the same transaction. Anything unread burns anyway when the expiry you chose arrives.

// what you get

Built so the middle holds nothing.

Every design decision points the same way: the server stores what it cannot read, for as short a time as possible.

Sealed on your device

AES-256-GCM with a key derived via HKDF-SHA256 from fresh random bytes — all on your phone, before a single byte is uploaded. The server receives ciphertext, full stop.

The key never travels

The decryption key rides in the link's #fragment. Browsers never send fragments to servers — not to ours, not to anyone's. Whoever holds the link holds the key; the server never does.

Burns on the last view

Set 1 to 100 views. When the last one is fetched, the ciphertext is deleted in the same database transaction — not on a cleanup schedule, not eventually. In the same moment.

Expires on schedule

Pick 1 hour to 30 days. A sweep runs every five minutes and deletes anything past its time, read or not. Nothing lingers because nobody clicked.

Passphrase second factor

Optionally require a passphrase, stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations and mixed into the key. Share it over a different channel and the link alone opens nothing.

Receipts, disclosed

Turn on a read receipt and you'll know when the note was opened — and the recipient is told before they reveal it. BurnPony does not do silent read tracking.

Burn it early

Every note you create appears in the Sent tab with live status — views used, opened times if receipts are on — and a burn button that deletes it from the server immediately.

A viewer you can read

Recipients get a single self-contained page: no frameworks, no cookies, no external requests, locked down with a strict Content-Security-Policy. View Source is the audit.

No account, ever

No sign-up to send, no sign-up to read, no username database, no analytics. There is nothing about you here to leak.

// the middle

The server holds ciphertext and a clock.

A note has to live somewhere between you writing it and them reading it. That somewhere stores a sealed blob it cannot open, a random ID, timestamps, and a view count — and once a note is burned, expired, or was never created at all, the link returns exactly the same response for all three, so the server can't even confirm a note ever existed. Prefer to run that middle yourself? The app's Settings accept a custom server URL. Read the full breakdown on the security page — or go all the way down: the v1 protocol specifies every byte, and the code is public.

// questions

Common questions.

Is BurnPony available yet?
Yes. BurnPony is free on the App Store for iPhone, and there is a desktop build for macOS, Linux, and Windows. It's also free on Google Play and F-Droid for Android.
Does the recipient need the app?
No. A note is one link that opens in any modern browser. The viewer page fetches the sealed note and decrypts it right there using the browser's built-in WebCrypto — the key rides in the part of the link after the #, which browsers never send to any server.
What can the server read?
Ciphertext it cannot open, plus the minimum bookkeeping: a random note ID, timestamps, the view allowance, and whether a receipt was requested. The decryption key never reaches it, and neither does the auto-hide setting, which travels encrypted inside the note.
What happens when the views run out?
The moment the last allowed view is fetched, the server deletes the ciphertext in the same database transaction. From then on the link returns exactly the same response as a note that expired — or one that never existed at all.
What does a passphrase add?
A second factor. The passphrase is stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations and mixed into the encryption key, so the link alone is no longer enough. Share it over a different channel than the link. Wrong guesses fail locally in the recipient's browser and never consume views.
Are read receipts silent tracking?
No. If you turn a receipt on, the recipient sees a notice before they reveal the note. You get a deliberately generic push — "A note was opened." — that carries no note content through Apple's servers.
How big and how long can notes be?
Up to 50,000 characters per note. Expiry runs from 1 hour to 30 days, and the view allowance from 1 to 100 views — whichever limit hits first burns the note.
Is it open source?
Yes, fully. The app, the relay server, and the viewer are public at github.com/norsehorse-dev/BurnPonyiOS under the Apache 2.0 license, together with the v1 protocol specification and the cross-implementation test vectors. Every note link is still its own audit too: the viewer is a single self-contained page, so View Source shows the exact program handling your key, and the shipped page is verifiably byte-identical to its published source.

Some things shouldn't sit in a chat log.

Send them as a note that reads once and burns, instead.

Download on the App Store Get it on Google Play Get it on F-Droid Download for desktop