Security

readonce.io stores a note until someone reads it once, or until it expires. After a successful read the key is deleted. There is no inbox and no way to list notes.

In transit

Browsers talk to the app over TLS (HTTPS). We do not add a second client-side encryption layer.

At rest

Each note gets its own random 256-bit data key. The note is encrypted with AES-256-GCM. That data key is wrapped with a server key-encryption key. Those keys are rotated periodically.

Once only

A note cannot be accessed twice. The first successful read destroys it.

What we do not log

We do not log note contents, passwords, password verifiers, or the pepper. If you choose to be notified when a note is read, the mail includes the optional description and never the contents, password, or share URL.

Description

The optional description is stored on the envelope, not in the encrypted payload, so the warning page can show it before you choose to read. Anyone with the link can see it. The note contents stay encrypted until a successful read.

Sign-in

Google is requested with openid email only. GitHub is requested with user:email only. Sessions are HMAC-signed cookies, HttpOnly, Secure, SameSite=Lax, lasting one week. We do not store an account database. Email-on-read uses the signed-in address.