Management token.
The sender's remote control. Proof that a note is yours to burn, without any account existing anywhere.
A management token is a random secret created alongside each note. Your phone keeps it; the server keeps only a hash. Presenting it authorizes exactly two things: reading the note's status and burning it early.
What it is
There are no accounts in BurnPony, so ownership can't mean "logged in as the sender." The token is ownership made concrete: whoever holds it controls the note's lifecycle, and nobody else — including the operator's database in the event of a breach, which holds only hashes.
Why it matters
It's also deliberately narrow. The token manages the note's existence; it cannot decrypt it. Even you can't read your own note back through the API — the key went into the link, not the token.
Related terms
Common questions.
Can someone with my link burn my note?
No. The link carries the note ID and decryption key; burning requires the management token, which never appears in the link.
Can the token read the note?
No. Decryption requires the fragment key from the link. Status and early burn are the token's entire power.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.