pqnote Secria

Send a password securely, with a note that self-destructs

Write it in a note that is encrypted in your browser. The reader opens the link once, then the note is deleted.

New noteOpening soon
The note tool opens here soon.

Got a pqnote link you didn’t expect? Report it.

How a pqnote link is designed

Before the #Goes to the server, which stores only the locked copy.

After the #: the keyStays in your browser. Browsers don’t send this part to the server.1

Until the tool opens, the guide below compares other ways to send a password. Checked 28 October 2026 against the sources.

How to send a password safely

Five steps for this site’s notes or any one-time link. One habit runs through them: splitting what you send across two routes, as Bitwarden suggests for its Send links.2

  1. Put only the password in the note.Leave out the username and the site, so a link that leaks shows a password with nothing to use it on.
  2. Choose the shortest expiry that works, and add a passphrase for anything important.Onetime Secret’s guidance suggests the shortest practical expiry, and a passphrase for highly sensitive information.3
  3. Send the link one way, for example by email or chat.
  4. Send the username and the passphrase another way: a call, a text, or in person.
  5. Ask the reader to change the password when they first sign in, if the account allows it.
If the link says the note was already readAsk the reader whether they opened it. If they didn’t, assume someone else did, and change the password.

Ways to send a password, compared

What each way leaves behind.

WayWhat stays behindWhat the reader needs
Email or text messageA copy at both ends, until someone deletes it.Nothing extra.
Chat with disappearing messagesWhatsApp, for exampleMessages disappear 24 hours, 7 days or 90 days after they are sent, unless someone keeps them. A backup made before then includes them.4The same app.
Password manager linkBitwarden Send, 1PasswordA Send is deleted after 7 days by default, 31 at most.5 1Password lets you choose when a shared link expires.6A browser. With 1Password, a check of their email address if you share the link only with them.6
One-time noteThis site, opening soonAn encrypted copy on the server until the first read or the expiry, when it is deleted.A browser, and the passphrase if you set one.
A call, or in personNothing written down.To be there.
 Vendor rows from each vendor’s help pages, read 28 October 2026.

Encrypted in your browser, or on the server

One-time note services differ in where the note is encrypted.

Encrypted in your browser

The note is locked on your device and the key goes into the link after the #, which the browser doesn’t send to the server.1 Privnote’s privacy policy and Bitwarden’s Send documentation describe this design, and pqnote is designed the same way.7, 2

The service stores the note without the key to open it.

Encrypted on the server

The text travels to the service over HTTPS and is encrypted when it arrives. Onetime Secret’s documentation describes server-side encryption, in transit and at rest.8, 9

The service handles the readable text while it makes the note.

What the pq stands forPost-quantum. pqnote is designed to seal each note with AES and a random 256-bit key that travels in the link, not to the server. NIST’s FAQ says AES-256 will still be safe for a very long time against quantum computers, assuming no new weaknesses are found in AES.10

Questions people ask

Is it safe to send a password by email or text?

It works, but a copy stays at both ends, in the sent folder and the inbox or the message thread, until someone deletes it. A one-time link, once read, leaves behind a link that no longer opens anything.

How does a self-destructing note work?

In the design pqnote follows, the note is encrypted on your device and the server keeps only the encrypted copy. The key rides in the link after the #, which the browser doesn’t send to the server.1 When the reader opens the link, their browser fetches the copy, unlocks it with the key, and the server deletes it. Bitwarden documents the same fetch-and-unlock steps for Send.2

What if a chat app opens the link before the reader does?

Some apps fetch links to build previews: Slack documents a bot that does exactly this.11 That is why a pqnote link is designed to open a page with a button first, so the note is fetched and deleted only when the reader presses it.

How do I spot a fake note site?

Check the address before you type anything. In April 2024 KrebsOnSecurity reported a network of Privnote copies on lookalike domains, pushed up in search results for “privnote”, that swapped cryptocurrency addresses inside notes.12 Bookmark the note site you use, and don’t sign in to anything a note links you to unless you expected it.

Sources 12
  1. URI fragment, MDN Web Docs. Read 28 October 2026.
  2. Send Encryption, Bitwarden Help Center. Read 28 October 2026.
  3. Security Best Practices, Onetime Secret documentation. Read 28 October 2026.
  4. About disappearing messages, WhatsApp Help Center. Read 28 October 2026.
  5. Send Lifespan, Bitwarden Help Center. Read 28 October 2026.
  6. Securely share 1Password items with anyone, 1Password Support, published 3 August 2026. Read 28 October 2026.
  7. Privnote Privacy Policy, last modified 25 May 2018. Read 28 October 2026.
  8. Onetime Secret Documentation, home page (“Server-side encryption”). Read 28 October 2026.
  9. Data Protection, Onetime Secret documentation. Read 28 October 2026.
  10. Post-Quantum Cryptography FAQs (“should we double the key length for AES now?”), NIST. Read 28 October 2026.
  11. Slack’s robots (Slackbot Link Expanding), Slack. Read 28 October 2026.
  12. Fake Lawsuit Threat Exposes Privnote Phishing Sites, KrebsOnSecurity, 4 April 2024. Read 28 October 2026.

Facts about other services come from their own help pages, documentation or policies, checked again from scratch and dated. How we check