Send a password, API key, or private note through a one-time link the server can't read. It's encrypted in your browser before it leaves — we store nothing but ciphertext, and the key lives only in the link. It self-destructs after one read or when the timer runs out.
# — that part never reaches the server.Passwords and API keys get pasted into Slack, email, and tickets every day — and they stay there forever, readable by anyone who later gets access. Whisprlink fixes that. Your secret is encrypted in your browser with AES-256-GCM before a single byte is sent. The server only ever receives an opaque blob it has no way to decrypt, because the key travels inside the link's # fragment, which browsers never transmit. That's what "zero-knowledge" means: even we can't read your secrets.
# stays client-side — it never reaches the server.No. It's encrypted in your browser before upload, and the key is never sent to us. We only store ciphertext we cannot decrypt.
The encrypted secret is deleted the instant it's first opened, so it can be read exactly once. If someone opens the link before your recipient, they'll see a "gone" page — a signal that something's wrong.
No signup, no email, no logs of your content. Just paste and share.
You pick an expiry from 10 minutes to one week. After that, it's permanently gone.
It uses standard AES-256-GCM via the browser's WebCrypto API. Zero-knowledge protects the content, not the fact that you shared something — so send links over a channel you trust and prefer burn-after-reading. See how it works for the full threat model.