Notes that burn after reading.
BurnPony seals a note on your phone with AES-256-GCM, hands you one link, and steps out of the way. The recipient opens it in any browser — no app, no account — and after the last allowed view the note is gone. The server in the middle only ever holds ciphertext.
Sealed on your phone. Burned after they read.
Free on the App Store, Google Play, and F-Droid.
Nothing to sign up for, nothing to configure. Install it, write a note, share the link.
BurnPony is free for iPhone. Download it on the App Store.
Free on Google Play and F-Droid. Get it on Google Play or get it on F-Droid.
macOS, Linux, and Windows builds, signed and checksummed. See the downloads.
Recipients never need an app. A note is one link that decrypts in any modern browser, on any platform.
Write it. Link it. Watch it burn.
The whole product is three steps, and the encryption happens before step two.
Write and seal
Type the note on your phone. Before anything is uploaded, it's encrypted on the device with AES-256-GCM — the key is derived from 32 fresh random bytes, and those bytes never leave your phone in any request.
Share one link
You get a single link with the decryption key tucked into its #fragment — the part browsers keep to themselves. Send it over any channel, or let the recipient scan the QR code in person. Want a second factor? Add a passphrase and share it separately.
It burns
The recipient taps Reveal in any modern browser and the note decrypts right there. On the last allowed view, the server deletes the ciphertext in the same transaction. Anything unread burns anyway when the expiry you chose arrives.
Built so the middle holds nothing.
Every design decision points the same way: the server stores what it cannot read, for as short a time as possible.
Sealed on your device
AES-256-GCM with a key derived via HKDF-SHA256 from fresh random bytes — all on your phone, before a single byte is uploaded. The server receives ciphertext, full stop.
The key never travels
The decryption key rides in the link's #fragment. Browsers never send fragments to servers — not to ours, not to anyone's. Whoever holds the link holds the key; the server never does.
Burns on the last view
Set 1 to 100 views. When the last one is fetched, the ciphertext is deleted in the same database transaction — not on a cleanup schedule, not eventually. In the same moment.
Expires on schedule
Pick 1 hour to 30 days. A sweep runs every five minutes and deletes anything past its time, read or not. Nothing lingers because nobody clicked.
Passphrase second factor
Optionally require a passphrase, stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations and mixed into the key. Share it over a different channel and the link alone opens nothing.
Receipts, disclosed
Turn on a read receipt and you'll know when the note was opened — and the recipient is told before they reveal it. BurnPony does not do silent read tracking.
Burn it early
Every note you create appears in the Sent tab with live status — views used, opened times if receipts are on — and a burn button that deletes it from the server immediately.
A viewer you can read
Recipients get a single self-contained page: no frameworks, no cookies, no external requests, locked down with a strict Content-Security-Policy. View Source is the audit.
No account, ever
No sign-up to send, no sign-up to read, no username database, no analytics. There is nothing about you here to leak.
The server holds ciphertext and a clock.
A note has to live somewhere between you writing it and them reading it. That somewhere stores a sealed blob it cannot open, a random ID, timestamps, and a view count — and once a note is burned, expired, or was never created at all, the link returns exactly the same response for all three, so the server can't even confirm a note ever existed. Prefer to run that middle yourself? The app's Settings accept a custom server URL. Read the full breakdown on the security page — or go all the way down: the v1 protocol specifies every byte, and the code is public.
Common questions.
Is BurnPony available yet?
Does the recipient need the app?
What can the server read?
What happens when the views run out?
What does a passphrase add?
Are read receipts silent tracking?
How big and how long can notes be?
Is it open source?
Some things shouldn't sit in a chat log.
Send them as a note that reads once and burns, instead.
Download on the App Store Get it on Google Play Get it on F-Droid Download for desktop