HKDF.
The step between "random bytes in a link" and "the key that opens the note."
HKDF (HMAC-based Key Derivation Function) derives cryptographic keys from input material. BurnPony feeds it the 32-byte fragment key — optionally combined with a PBKDF2-stretched passphrase — plus a random 16-byte salt and a fixed context string, and gets the AES-256-GCM key out.
What it is
Derivation adds discipline. The bytes in your link are never used directly as the encryption key; they're input material, bound by the salt and a version-specific context so keys from one purpose or format version can't be confused with another.
Why it matters
It's also the clean junction point for the passphrase feature: with no passphrase, HKDF processes the fragment key alone; with one, the stretched passphrase is mixed in — one derivation path, two strength levels, no special cases in the format.
Related terms
Common questions.
Why not use the fragment key directly?
Direct use would tie the link format to the cipher forever and leave nowhere to bind the salt, the passphrase, or a version. HKDF gives each note a properly derived key and gives the format room to evolve.
What does the salt do?
It's 16 fresh random bytes stored openly in the envelope, ensuring the derived key is unique per note even in unlucky scenarios — a standard belt-and-braces measure that costs nothing.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.