Question 1

What is BurnAfterRead?

Accepted Answer

BurnAfterRead lets you share passwords, API keys, and other sensitive information through an encrypted, one-time link. The link opens successfully exactly once — after that, it's permanently destroyed.

Question 2

What is a one-time secret link?

Accepted Answer

A one-time secret link is a URL that reveals its content the first time it's opened, then stops working. The first person to open it sees the secret; anyone who opens the same link afterward — including the original sender — sees that it's already been viewed, not the secret itself.

Question 3

Does BurnAfterRead require an account?

Accepted Answer

No account is required to send or open a text secret. An account is required to send or view an image/media secret, and it also unlocks a dashboard showing every secret you've sent and whether it's been opened yet.

Question 4

How long does a secret remain accessible?

Accepted Answer

You choose an expiration when you create the link: 15 minutes, 1 hour, 1 day, 7 days, 15 days, or 30 days. If nobody opens it before that time, it's automatically deleted — it doesn't just sit expired in the database.

Question 5

What happens after a secret is opened?

Accepted Answer

The moment the link is opened, the server immediately overwrites the stored ciphertext (for text) or deletes the uploaded files (for images) and marks the link as viewed. Reopening the same link afterward shows it's already been burned. The revealed content also auto-hides from the screen after a short countdown — 3 minutes by default, adjustable from 30 seconds to 10 minutes — as an extra safeguard against someone reading over your shoulder.

Question 6

Can I restrict a secret to specific countries?

Accepted Answer

Yes — the "Geo policy" option lets you either allow only selected countries or block selected countries from opening the link. This is detected from the viewer's IP address; if that lookup fails for any reason, the link stays open rather than locking everyone out.

Question 7

Can I restrict a secret to my company's email domain?

Accepted Answer

Yes — domain restriction lets you limit who can open a secret to email addresses on domains you specify (e.g. "company.com"). Within an organization workspace this can also be set as a locked default so every secret created there automatically requires it, without each sender having to set it manually.

Question 8

Can I leave a private note on a secret I've sent?

Accepted Answer

Yes — the "Internal note to yourself" field is only visible to you, in your own list of sent secrets. It's never shown to the recipient, so it's a good place to note what a credential was for or which ticket it relates to.

Question 9

Can I include a message for the recipient?

Accepted Answer

Yes — a "Message to the recipient" is shown to them alongside the secret when they open the link, separate from the secret content itself.

Question 10

Can I let recipients download an image I send?

Accepted Answer

Yes, it's your choice. For image/media secrets, "Allow recipient download" is on by default; turning it off lets the recipient view the image once with no download button shown.

Question 11

Can I require recipients to confirm before revealing a secret?

Accepted Answer

Yes — this is an account-level default (under Settings), on by default, that requires anyone opening your secrets to check a box confirming they understand it will be permanently destroyed before they can reveal it. It applies to every secret you create, including links you've already sent.

Question 12

Can I request a secret from someone instead of sending one?

Accepted Answer

Yes — "Requests" lets you ask someone to send you a secret, rather than the other way around. Enter their email address and an optional message, and they get a link to respond.

Question 13

Does the person I'm requesting from need an account?

Accepted Answer

They can view your request and decline it without an account, but they do need to log in before they can fulfill it — that way the secret they send back is tied to an identified sender, not an anonymous link.

Question 14

What happens when someone fulfills my request?

Accepted Answer

They're taken straight to the normal create-secret flow, pre-addressed to you. Once they send it, your request is automatically marked fulfilled and linked to that secret.

Question 15

Can the other person decline my request?

Accepted Answer

Yes — declining is always available to them, and it marks the request as declined rather than leaving it pending indefinitely.

Question 16

How long does a secret request stay open?

Accepted Answer

7 days by default. If it isn't fulfilled or declined by then, it expires automatically.

Question 17

What's under "Collaboration" in the sidebar?

Accepted Answer

Four tools for working with other people: "Shared with me," "Requests," "Contacts," and "Groups" — covered in the questions below (Requests has its own section above).

Question 18

What shows up under "Shared with me"?

Accepted Answer

Secrets that have been sent to you — both the ones still waiting to be opened and everything you've already opened.

Question 19

Are my saved contacts visible to the rest of my team or organization?

Accepted Answer

No. Contacts are always private to the person who saved them, even when they're saved while working in an organization workspace — organization context only affects which contacts you see suggested, not who else can see them.

Question 20

What are groups, and who can create one?

Accepted Answer

A group bundles a set of contacts under a name so you can send a secret to all of them at once. Anyone can create a group, in a personal workspace or within an organization. Inside an organization, an admin or owner can additionally choose to make a group visible to everyone there; otherwise — and always, for a group made by a regular member — it stays private to whoever created it.

Question 21

When I send a secret to a group, do all the members share one link?

Accepted Answer

No — each member gets their own independently-encrypted, one-time link. Opening one member's link has no effect on anyone else's; it's the same as sending that many separate secrets at once, not one secret shared between several people.

Question 22

What notifications does BurnAfterRead send?

Accepted Answer

With an account, you can be notified about your secrets' lifecycle — when one is opened, received, expires unopened, is destroyed, or is declined by the recipient — plus security-relevant events like a blocked access attempt or a recipient reporting they couldn't open a secret. If you're part of an organization, you also get notifications for things like invitations and role changes.

Question 23

Can I control which notifications I get by email vs. in-app?

Accepted Answer

Yes. There's a master on/off switch for each channel (email and in-app), plus independent email and in-app toggles for each event type, so you can get some events only in-app and others by email, or turn specific ones off entirely.

Question 24

Will I be notified when someone opens a secret I sent?

Accepted Answer

Yes, by default — both as an in-app notification and by email. You can turn either of those off individually in your notification settings.

Question 25

Does BurnAfterRead automatically remind recipients about unopened secrets?

Accepted Answer

By default, yes — unopened secrets get an automatic reminder. You can turn this off in your settings if you'd rather not send automatic reminders; manually sending a one-off reminder is always available regardless of that setting.

Question 26

Can I get browser push notifications or sound alerts?

Accepted Answer

Yes, both are available but off by default — you can turn on browser notifications and/or a sound alert for new activity in your notification settings.

Question 27

Can I password-protect a secret?

Accepted Answer

Yes. You can optionally set a password when creating a secret — the recipient has to enter it correctly before the link will reveal anything.

Question 28

Can I restrict who's allowed to open a secret?

Accepted Answer

Yes. You can require the recipient to log in with a specific email address, or, for secrets created within an organization, restrict access to anyone signed in with an email on your company's domain.

Question 29

Are there limits on secret size or file uploads?

Accepted Answer

Text secrets are capped at 10,000 characters. Image secrets can include up to 6 images per link, compressed down to a combined total of roughly 3MB.

Question 30

Can I decline a secret without opening it?

Accepted Answer

Yes. Declining destroys the secret immediately, the same as opening it would — except nobody, including you, ever sees the plaintext.

Question 31

What are the limitations of one-time secret sharing?

Accepted Answer

By default, whoever has the link can open it — there's no identity check unless the sender specifically restricted access to an email or domain. If the link is intercepted before the intended recipient opens it (forwarded by mistake, visible in an unlocked phone's notification, exposed in a chat log), whoever opens it first gets the secret, and the real recipient just finds a dead link. The decryption key travels inside the link itself and is never stored on the server, so if the link is lost before anyone opens it, the secret can't be recovered by anyone — including BurnAfterRead.

Question 32

How does BurnAfterRead protect secrets?

Accepted Answer

Secrets are encrypted in your browser before anything is sent, using a key that lives only in the link itself — browsers never transmit that part of the URL to any server. BurnAfterRead's database stores ciphertext it can't decrypt, and erases it the moment the link is opened.

Questions people actually ask.

General

Advanced settings when creating a secret

Secret requests

Collaboration

Notifications

Security & limitations