Self-destructing notes, encrypted end to end.

Sometimes you need to send something sensitive to someone who doesn't use the same messenger as you: a Wi-Fi password, a door code, login details for a shared account, an address, a private message you don't want sitting in their inbox forever. Pasting it into e-mail or SMS leaves a permanent copy in places you don't control. Private notes in Frozen Chat solve that: the note is encrypted on your phone, travels as a link, can be read exactly once, and then destroys itself.

How it works

1. Write the note in the Frozen Chat app, up to 10,000 characters.
2. Choose an expiry: 1 hour, 1 day, 7 days or 30 days. Unread notes are deleted when they expire.
3. Optionally add a password to share through a different channel, and turn on Tell me when it's read.
4. Create the link and send it through any app: e-mail, SMS, another messenger.
5. The recipient opens it once in any browser and taps Show note. The note is shown, and at the same moment deleted from our server. The link stops working.

Why we can't read your notes

Many “self-destructing message” websites encrypt your note on their server, which means the server sees the text, at least for a moment. Frozen Chat does it differently. The note is encrypted inside the app with AES-256-GCM, using a random 256-bit key. A link looks like this:

frozenchat.com/n/#note-id.secret-key

Everything after the # is the URL fragment. Browsers never send the fragment to a server, so neither the note id nor the key reaches our server or the network in between. When the recipient opens the link, their browser fetches the encrypted note and decrypts it locally with the key from the fragment, using the browser's built-in WebCrypto. Our server only ever stores ciphertext it has no key for.

If you add a password, it is stretched with PBKDF2 (600,000 iterations) and mixed into the key, so the link alone isn't enough to read the note. After 10 wrong password attempts in total the note is deleted, to stop guessing.

Read once means read once

Opening a note and deleting it happen in the same database transaction. There is no “soft delete” and no copy kept for later: once the note has been shown, the server no longer has it, and the link shows “This note doesn't exist”. Expired notes are purged every hour. Note ids are never logged.

One honest caveat: “read once” protects the note on our side. The person reading it can still copy the text or take a screenshot, so send notes to people you trust with the contents.

Know when it has been read

With Tell me when it's read turned on, the app gets a notification when the note is opened. If you get that notification and the intended person says they never opened it, you know someone else did, and it is time to change that password. In the app's My notes list you can see each note's state (waiting, read, expired or deleted), copy a link again, or delete a note that hasn't been opened yet.

Good uses for private notes

• Passwords, PINs, recovery codes and Wi-Fi keys.
• Bank details or addresses you don't want stored in someone's e-mail.
• One-off credentials for a contractor or a new colleague.
• A private message to someone who doesn't use Frozen Chat yet.

For conversations with people who do use Frozen Chat, regular chats are already end-to-end encrypted, and you can send one-time photos and videos that disappear after viewing. Teams often use notes alongside group chats: see secure messaging for business.

Getting started

Private notes are part of the Frozen Chat app and need an active licence to create. Readers need nothing at all. Follow the getting started guide to set up the app with just a username, and compare plans on the pricing page.