Management token.

The sender's remote control. Proof that a note is yours to burn, without any account existing anywhere.

// definition

A management token is a random secret created alongside each note. Your phone keeps it; the server keeps only a hash. Presenting it authorizes exactly two things: reading the note's status and burning it early.

What it is

There are no accounts in BurnPony, so ownership can't mean "logged in as the sender." The token is ownership made concrete: whoever holds it controls the note's lifecycle, and nobody else — including the operator's database in the event of a breach, which holds only hashes.

Why it matters

It's also deliberately narrow. The token manages the note's existence; it cannot decrypt it. Even you can't read your own note back through the API — the key went into the link, not the token.

// in BurnPony The Sent tab uses each note's token automatically for live status (views used, receipt times) and for the Burn button. Only the ID, token, and settings are stored on your device — never the note text. Lose the phone and the notes still expire on their own; what you lose is the remote control.

Related terms

Common questions.

Can someone with my link burn my note?

No. The link carries the note ID and decryption key; burning requires the management token, which never appears in the link.

Can the token read the note?

No. Decryption requires the fragment key from the link. Status and early burn are the token's entire power.

Get BurnPony

Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.