Send a secret. It disappears the moment it's read.

Zero-knowledge, one-time links for anything you'd rather not leave sitting in an inbox or a chat log. No account, no tracking, nothing left behind.

End-to-end encryptedZero-knowledgeNo accountAuto-destructPassphrase protectionDuress passphraseDecoy messageOne-time linkHosted in the EU100% free
0 / 100,000 bytes🔥 Always deletes after read
Expires inHow long the link stays valid before it self-destructs unopened.
Add a passphraseIf you add a passphrase, the link alone won't be enough — the recipient will also need the passphrase to open it.

What ends up going through Selfdestruct

A password you'd rather not type into a chat box

Wi-Fi codes, shared logins, a one-off staging password — handed over once, then gone.

Something with a name and a number attached

Bank details, ID numbers, anything you wouldn't want sitting in someone's inbox.

A handoff between people who don't share a Slack

SSH keys, API tokens, database access — passed to a contractor or client without a permanent trail.

A message meant to be read exactly once

Something personal, awkward, or just none of anyone else's business.

Built-in protection

Zero-knowledge encryption

Encryption happens on your device, before anything is sent. We store scrambled bytes we can't unscramble — there's no key on our end to lose, hand over, or be compelled to produce.

One-time, self-destructing link

The link works exactly once. The moment it's opened, the secret is deleted — permanently, not just hidden.

Duress passphrase

An optional second passphrase that reveals a stand-in message instead of the real secret — indistinguishable from the real one to anyone watching.

Quick exit

A one-click way to leave instantly and land somewhere neutral, available on every page — the small button in the header. If you ever need it, it's always right there.

No accounts, ever

Nothing to sign up for on either end. No email, no password to reuse, no profile tying a secret back to you.

EU-hosted infrastructure

Runs on servers we operate, headquartered in the EU — not just an EU region of a company based elsewhere. Real jurisdiction, not a marketing distinction.

No logs of what you send

No per-secret or per-visitor logging, no analytics scripts, nothing to subpoena that would reveal a secret's contents after the fact.

How it works

Sender's browserServerciphertext onlyRecipient's browserciphertextciphertextdecryption key — never sent to the server

The ciphertext and the decryption key take different paths — the key never reaches the server. See the full breakdown, FAQ, and warrant canary →

Compared to how you'd normally send this

Email and chat apps weren't built for one-time secrets. Here's what changes when you use a tool that is.

SelfdestructEmailChat & video apps
End-to-end encrypted✓✗–
Deleted after reading✓✗✗
Server never sees plaintext✓✗–
No account required to send✓✗✗
Leaves no message history✓✗✗
Built-in expiration timer✓✗✗
Duress passphrase✓✗✗