OneTaskBy Tim King · Updated
Secure Note
Passphrase-Protected Encrypted Link With No Server Storage, Built Entirely in Your Browser
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Secure Note works
This secure note tool turns a password, key or private message into an encrypted link that opens only with a passphrase. The note is sealed in your browser and carried inside the link itself, so no server ever stores or sees it. Send the link one way and the passphrase another.
How the secure note link works
Type the note and a passphrase. The page derives a key from the passphrase with PBKDF2 using 600,000 rounds of SHA-256 and a random salt, then encrypts the note with AES-256-GCM. The salt, nonce and ciphertext are packed into the part of the link after the # sign.
Browsers never send that fragment to the web server, so the encrypted note stays between you and the person you give the link to. When they open it, this page fills in the link and switches to open mode. They enter the passphrase and the note is decrypted on their device. A wrong passphrase or a damaged link fails the integrity check instead of showing garbage.
Because the note lives in the link, it does not expire or delete itself after reading. Anyone who has both the link and the passphrase can open it, so share them through different channels, such as the link by email and the passphrase by phone.
FAQ
Is the note stored on your server?
No. There is no database behind this page. The encrypted note is the text after the # in the link, and browsers do not send that part to the server, so it appears in no request logs.
Can I make the note self-destruct?
Not with a link that holds the whole note, since anyone keeping a copy can open it again. If the note is a password, change it once the other person has used it, which achieves the same effect.
What makes a good passphrase?
Use four or more random words or at least twelve random characters. The slow key derivation makes guessing expensive, but a short or common passphrase can still be cracked by someone who has the link.
Why is the link so long?
It carries the whole encrypted message plus a salt and nonce, encoded as text. Long notes make long links, and some chat apps cut very long links short, so keep notes brief or use the file encryptor.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Text Encryptor
Encrypt and decrypt messages with a passphrase, AES-256-GCM in your browser.
Secret Splitter
Split a secret into shares; any threshold of them rebuilds it.
File Encryptor
Password-encrypt any file with AES-256-GCM, without uploading it.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.