WebCrypto.
The reason the recipient needs no app: the browser already contains the cryptography.
WebCrypto (the Web Cryptography API) is a standard JavaScript interface to the browser's native crypto engine. BurnPony's viewer uses it for everything — HKDF, PBKDF2, and AES-256-GCM — with zero bundled libraries.
What it is
Using the platform's crypto keeps the viewer honest in two ways. It stays small enough to audit with View Source, because there's no 500-kilobyte library to wade through. And the actual cipher runs in the browser's own audited, hardware-accelerated implementation rather than JavaScript someone shipped.
Why it matters
It also guarantees reach: any modern browser on any device can open a note. "Recipients need no app" is only true because the crypto they need is already installed.
Related terms
Common questions.
Which browsers work?
Any modern browser — the WebCrypto operations BurnPony uses have been standard across Safari, Chrome, Firefox, and Edge for years. Very old browsers without WebCrypto can't decrypt, which is the correct failure.
Does using browser crypto mean the server runs the code?
The server delivers the viewer page once; everything cryptographic then executes locally in your browser. The page's Content-Security-Policy forbids it from loading code from anywhere at all.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.