Why I Built a Zero-Knowledge, Client-Side Encrypted Burning Note App Over the Weekend

I recently developed a zero-knowledge, client-side encrypted burning note application called ScorchNote, which aims to securely share temporary credentials and sensitive text without relying on server-side encryption. The primary concern with using traditional one-time secret web tools is that they encrypt and decrypt data on their servers, forcing users to trust the backend configurations, logging policies, and database security.

My goal was to create a truly zero-knowledge application where the server owner has no ability to access the notes, even if they desired.

ScorchNote achieves this by utilizing strict client-side mechanics. When a user types a secret, it gets encrypted directly in their browser before leaving their network interface. The encryption key, necessary to decrypt the note, is generated and stored inside the URL's hash fragment (the portion after the #). Crucially, web browsers do not transmit the hash fragment in HTTP requests to the host server, meaning my database only receives encrypted data, scrambled beyond recognition. Consequently, the server has no knowledge of what the encryption key is.

Furthermore, the note is only visible on the recipient's screen for a brief moment after they click the link. Immediately upon loading, the encrypted payload is fetched from the server and then permanently deleted from the server's database. The application has been designed to be lightweight, minimalist, and devoid of any unnecessary tracking scripts, focusing solely on its primary function of securely and instantly sharing information.

I am eager to receive feedback on the architecture, user experience, and any additional features that might enhance the application in the future. Please visit ScorchNote to review the implementation.