How it works

BitandBurn

BitandBurn is a simple one-time message drop. A sender writes a message, the message is encrypted in the browser, and a passphrase is generated for the recipient. The recipient enters that passphrase to retrieve the message once. After retrieval, the stored encrypted message is deleted.

The goal of the site is to provide a lightweight way to share a message without creating an account, starting a conversation thread, leaving the message sitting around indefinitely, downloading an app, or seeing ads.

BitandBurn uses browser-based encryption so that messages are encrypted before they are sent to the server. The server stores only encrypted data and the information needed to retrieve it. When the recipient enters the correct passphrase, the encrypted message is retrieved, decrypted in the browser, displayed once, and then deleted from storage.

Technology and security practices

Messages are protected with end-to-end encryption with encryption and decryption happening in the user’s browser and are never stored in plaintext. Messages are intended to be retrievable only once and are deleted immediately after successful retrieval.

The site uses its own server-side endpoints to store and retrieve encrypted payloads. No public user account system is required.

Cookies and tracking

BitandBurn is designed to operate without user accounts or cookies.

Privacy

BitandBurn is built to minimize the amount of information stored. The message system is designed so that messages are encrypted before upload and removed after retrieval. No permanent inbox, account history, or message archive is provided.

Like most websites, basic server logs may still exist for operational and security purposes, such as diagnosing errors, preventing abuse, and maintaining site stability. These logs may include technical information such as IP addresses, browser details, and request timestamps.

Important limitations

While BitandBurn is designed with privacy in mind, no website can promise perfect security. Users should not rely on the service for life-critical, high-risk, or legally sensitive communications. The security of the system depends not only on the encryption design, but also on the security of the device, browser, and how the code is shared between parties.

Contact and support

BitandBurn is an independent project. If you have enjoyed using the site and would like to support its development, you can do so here: ko-fi.com/coreykelsey.