AES-256-GCM.
The lock on every note. A 256-bit key, and a seal that breaks visibly if anyone touches the contents.
AES-256-GCM is the Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode — authenticated encryption that both hides the plaintext and detects any modification of the ciphertext. BurnPony uses it with a 12-byte nonce and a 16-byte authentication tag.
What it is
GCM's authentication is the quietly important half. Encryption alone scrambles data; authenticated encryption also proves nobody flipped a bit in transit or in storage. A tampered BurnPony envelope doesn't decrypt to subtly wrong text — it refuses to decrypt at all.
Why it matters
It's also the most audited symmetric choice available: hardware-accelerated on phones, native in every browser's WebCrypto, and standardized for two decades. BurnPony's crypto is deliberately boring; the interesting part is where the key travels, not how the lock works.
Related terms
Common questions.
Why AES-256-GCM and not something exotic?
Because notes deserve the most scrutinized primitive available, not the most fashionable one. AES-GCM is standardized, hardware-accelerated, and implemented natively in both Swift's CryptoKit and every browser's WebCrypto — which lets the viewer stay a small, auditable page.
What are the nonce and tag for?
The 12-byte nonce makes each encryption unique even under the same key; the 16-byte tag is the tamper seal. If ciphertext, nonce, or tag were altered anywhere, decryption fails outright.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.