URL fragment.
The one part of a URL your browser keeps to itself. BurnPony's whole trust model lives there.
The URL fragment is everything after the # in a URL. Browsers use it locally and, per the HTTP standard, never include it in requests. A BurnPony link — burnpony.app/n/<id>#<key> — carries the note ID before the #, and the base64url-encoded 32-byte key after it.
What it is
This is what makes "the server cannot read your note" a structural fact rather than a policy. The request that fetches a note contains the ID and nothing else; the key arrives in the recipient's browser through the link itself and goes no further.
Why it matters
It's also checkable from the outside: open a note with the network inspector running and watch — no request contains the fragment. You don't have to trust the operator's intentions when the browser enforces the boundary.
Related terms
Common questions.
Never sent to servers — really?
Really. Omitting the fragment from requests is standard browser behavior, consistent across every modern browser, and it's why fragment-key designs exist. The viewer additionally sets a no-referrer policy so the URL doesn't leak via referrer headers either.
What if I paste the link somewhere that logs it?
Then that place holds the key — the link is the secret. Send it over a channel you'd trust with the note itself, or add a passphrase so the link alone isn't enough.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.