Skip to content
VailNote - Secure Encrypted Note Sharing

the server only sees ciphertext

Share secrets that vanish.

Encrypted in your browser, unreadable to the server, gone after viewing. True zero-knowledge.

Create a note

Adds a second factor: the reader needs both the link and this password.

Unopened notes are deleted automatically after this long.

Turns off destroy-after-viewing, so the note stays until someone deletes it. Anyone with access can delete it, so use with care.

All encryption happens in your browser - we never see your data

How it works

  1. 01WRITE

    Write your note

    Encrypted with AES-256-GCM in your browser before anything touches the network.

  2. 02SHARE

    Share the link

    The decryption key rides in the link fragment, the part of a URL browsers never send to servers.

  3. 03DESTROY

    Read once, then gone

    Opening the note destroys it. Unopened notes expire on a schedule you set, 10 minutes to 90 days.

READOUT / SERVER SIDE

What reaches our server

Encryption happens before upload - in your browser or the CLI - and the key never leaves the link fragment. All we can store is ciphertext with an expiry date.

  • Keys stay with you

    Link keys live in the URL fragment. Password keys are derived in your browser with PBKDF2.

  • Ciphertext at rest

    The database holds encrypted bytes and an expiry date. Passwords are stored only as bcrypt hashes.

  • Nothing to correlate

    No analytics and no ad scripts. Rate limiting uses anonymous credentials (ARC) instead of logging who you are.

  • Same rules for the CLI

    vailnote-cli encrypts before upload, reads secrets from stdin, and resolves .env links in memory - argv and disk never see the key.

Read the agent docs
YOU WRITE

door code is 4417, delete this after reading

WE STORE

o5T9dXcE2K/wYq7hZk0mQxV3sB1uNfLgjRa8pDwiCH6yUOJtM4vGnrPS+Abek9zFqW5hT2cLxYmD0uK8sNVi7EJgw==

Illustrative ciphertext (example). The transformation happens entirely in your browser.
AGENT → VAILNOTE

npm install -g vailnote-cli

echo "sk-…" | vailnote create --expires-in 7d

→ https://vailnote.com/8f2a9c…#auth=Xk1…

vailnote read "https://vailnote.com/8f2a9c…#auth=Xk1…"

sk-…

note destroyed after first read

Plaintext exists only in the CLI's memory - never on disk.

PRIVACY IS NOT A GIFT

Fight Chat Control

The EU's Chat Control law allows AI scanning of private messages. Learn how to act.

100% Open-Source

Every line of code that touches your notes is public, MIT-licensed, and self-hostable. Audit it, fork it, or run your own.

View source on GitHubRead the privacy policy
LICENSE
MIT
TRACKING
none
SELF-HOST
yes