◇
Client-side encryption
A fresh 256-bit key and IV are generated for every note using the browser Web Crypto API.
Open source · privacy by design
Share a secret.
Leave no note behind.
notefor.one encrypts a note in your browser, shares it through a one-time link, and permanently removes it when the recipient reveals it.
AES-256-GCMNo accountsNo tracking
ENCRYPTED LOCALLY 01
# key stays in the link
⌁AES
256
256
✓
Note revealedCiphertext permanently removed
Encryption happens in the browserThe server never receives the keyEvery note has an expiry
Small attack surface
Built around the secret, not around you.
No profiles, analytics, advertising, or unnecessary personal data. The project stays focused on one private exchange.
1
Atomic one-time reveal
MongoDB removes the ciphertext atomically, preventing a second reader from consuming the same note.
⌛
Automatic expiry
Unopened notes are cleaned up through a TTL index after the lifetime selected by the sender.
#
Key outside requests
The encryption key lives in the URL fragment, which browsers do not send to the application server.
◉
Preview-safe links
Chat and email previews cannot destroy a note. Revealing it always requires an explicit action.
↗
Free to self-host
Run the Node.js application and MongoDB on infrastructure you control under the MIT license.
End-to-end flow
The plaintext stays at the edges.
- 01Write
The sender types a note in their browser.
- 02Encrypt
The browser encrypts it before anything is uploaded.
- 03Share
The recipient gets a link carrying the decryption key after #.
- 04Reveal once
The server deletes the ciphertext and the browser decrypts locally.
Transparent security model
Know exactly where the key goes.
The server stores ciphertext, IV, identifier, and timestamps — never the note's plaintext or encryption key. The public security policy documents both protections and limits.
Read the security policy ↗SENDER BROWSERPlaintext → AES-GCM
ciphertext→
PRIVATE STORAGEMongoDB
SHARED URL
note/id#encryption-key
Run it on your infrastructure
The project is available. The service is not hosted here.
This website describes the open-source project; it does not operate a public note-sharing instance. Clone the repository to inspect, modify, contribute, or deploy your own instance with HTTPS and MongoDB.
Open by design
Use it. Inspect it. Improve it.
Bug reports, security research, documentation, design ideas, and pull requests are welcome.