pqnote Secria

Send a password securely, with a note that self-destructs

Write it in a note that is encrypted in your browser. The reader opens the link once, then the note is deleted.

New noteOpens once

Delete it

After it is read once

Send the passphrase another way, for example in a call.

Got a pqnote link you didn’t expect? Report it.

How a pqnote link is designed

Before the #Goes to the server, which stores only the locked copy.

After the #: the keyStays in your browser. Browsers don’t send this part to the server.1

Not sure a note is right? The guide below compares other ways to send a password. Checked 28 October 2026 against the sources.

How to send a password safely

Five steps for this site’s notes or any one-time link. One habit runs through them: splitting what you send across two routes, as Bitwarden suggests for its Send links.2

  1. Put only the password in the note.Leave out the username and the site, so a link that leaks shows a password with nothing to use it on.
  2. Choose the shortest expiry that works, and add a passphrase for anything important.Onetime Secret’s guidance suggests the shortest practical expiry, and a passphrase for highly sensitive information.3
  3. Send the link one way, for example by email or chat.
  4. Send the username and the passphrase another way: a call, a text, or in person.
  5. Ask the reader to change the password when they first sign in, if the account allows it.
If the link says the note was already readAsk the reader whether they opened it. If they didn’t, assume someone else did, and change the password.

Ways to send a password, compared

What each way leaves behind.

  • Email or text message

    A copy at both ends, until someone deletes it.

    What the reader needsNothing extra.

  • Chat with disappearing messages

    WhatsApp, for example

    Messages disappear 24 hours, 7 days or 90 days after they are sent, unless someone keeps them. A backup made before then includes them.4

    What the reader needsThe same app.

  • Password manager link

    Bitwarden Send, 1Password

    A Send is deleted after 7 days by default, 31 at most.5 1Password lets you choose when a shared link expires.6

    What the reader needsA browser. With 1Password, a check of their email address if you share the link only with them.6

  • One-time note

    This site

    An encrypted copy on the server until the first read or the expiry, when it is deleted.

    What the reader needsA browser, and the passphrase if you set one.

  • A call, or in person

    Nothing written down.

    What the reader needsTo be there.

Vendor rows from each vendor’s help pages, read 28 October 2026.

Encrypted in your browser, or on the server

One-time note services differ in where the note is encrypted.

Encrypted in your browser

The note is locked on your device and the key goes into the link after the #, which the browser doesn’t send to the server.1 Privnote’s privacy policy and Bitwarden’s Send documentation describe this design, and pqnote is designed the same way.7, 2

The service stores the note without the key to open it.

Encrypted on the server

The text travels to the service over HTTPS and is encrypted when it arrives. Onetime Secret’s documentation describes server-side encryption, in transit and at rest.8, 9

The service handles the readable text while it makes the note.

What the pq stands for

Post-quantum. pqnote is designed to seal each note with AES and a random 256-bit key that travels in the link, not to the server. NIST’s FAQ says AES-256 will still be safe for a very long time against quantum computers, assuming no new weaknesses are found in AES.10

Questions people ask

Is it safe to send a password by email or text?

It works, but a copy stays at both ends, in the sent folder and the inbox or the message thread, until someone deletes it. A one-time link, once read, leaves behind a link that no longer opens anything.

How does a self-destructing note work?

In the design pqnote follows, the note is encrypted on your device and the server keeps only the encrypted copy. The key rides in the link after the #, which the browser doesn’t send to the server.1 When the reader presses the button on the page the link opens, the server hands over the copy and deletes it in the same step, and the reader’s browser unlocks it with the key. Bitwarden documents the same fetch-and-unlock steps for Send.2

What if a chat app opens the link before the reader does?

Some apps fetch links to build previews: Slack documents a bot that does exactly this.11 That is why a pqnote link opens a page with a button first: loading the page only checks that the note exists, and the note is fetched and deleted when someone presses the button.

How do I spot a fake note site?

Check the address before you type anything. In April 2024 KrebsOnSecurity reported a network of Privnote copies on lookalike domains, pushed up in search results for “privnote”, that swapped cryptocurrency addresses inside notes.12 Bookmark the note site you use, and don’t sign in to anything a note links you to unless you expected it.

Sources 12
  1. URI fragment, MDN Web Docs. Read 28 October 2026.
  2. Send Encryption, Bitwarden Help Center. Read 28 October 2026.
  3. Security Best Practices, Onetime Secret documentation. Read 28 October 2026.
  4. About disappearing messages, WhatsApp Help Center. Read 28 October 2026.
  5. Send Lifespan, Bitwarden Help Center. Read 28 October 2026.
  6. Securely share 1Password items with anyone, 1Password Support, published 3 August 2026. Read 28 October 2026.
  7. Privnote Privacy Policy, last modified 25 May 2018. Read 28 October 2026.
  8. Onetime Secret Documentation, home page (“Server-side encryption”). Read 28 October 2026.
  9. Data Protection, Onetime Secret documentation. Read 28 October 2026.
  10. Post-Quantum Cryptography FAQs (“should we double the key length for AES now?”), NIST. Read 28 October 2026.
  11. Slack’s robots (Slackbot Link Expanding), Slack. Read 28 October 2026.
  12. Fake Lawsuit Threat Exposes Privnote Phishing Sites, KrebsOnSecurity, 4 April 2024. Read 28 October 2026.

Facts about other services come from their own help pages, documentation or policies, checked again from scratch and dated. How we check