Does "burn after reading" guarantee that the recipient has no copy of the secret?

No. When a secret is "burned," the service permanently purges the stored encrypted payload from its servers so the link cannot be opened again. However, once the recipient has decrypted and viewed the plaintext in their browser, they could take a screenshot, write it down, or copy it to their clipboard.

What is the difference between "burn after reading" links and disappearing chat messages?

Disappearing chat messages (like in Signal or WhatsApp) are conversation threads that delete messages on a timer (e.g., 24 hours or 7 days) within an installed mobile app. A burn-after-reading link is an ephemeral web link that can be shared over any channel and is purged from the server after a specific number of views (usually 1 view).

Can a burned secret ever be recovered by Paste & Purge support or administrators?

No. When a secret is read or reaches its expiration limit, the ciphertext record is atomically deleted from the database. Furthermore, because Paste & Purge uses zero-knowledge encryption, the server never possessed the decryption key in the first place.

What happens if a burn-after-reading link is never clicked by the recipient?

Every secret created on Paste & Purge has a mandatory expiration timer (from 5 minutes up to 7 days). If the recipient never opens the link before the timer expires, background cleanup workers permanently delete the unread secret record.

Can I require a password to view a burn-after-reading secret?

Yes. You can add an optional passphrase. The recipient must enter the correct passphrase before the client browser can decrypt the payload. If they enter an incorrect passphrase, the ciphertext remains unreadable.

Can a burn-after-reading link allow more than 1 view?

Yes. While 1 view is the most common setting for maximum security, Paste & Purge allows you to configure up to 5 views if multiple team members need to access the secret before it is purged.

Security Terminology Guide

What Does "Burn After Reading" Mean? How Self-Destructing Messages Work

Published by Paste & Purge · Educational Guide · 8 min read

The phrase "burn after reading" originated conceptually in classic espionage literature and diplomatic protocols, describing physical orders or cipher sheets that had to be incinerated immediately after being read so no physical evidence remained for adversaries to discover.

In digital security, "burn after reading" refers to ephemeral, self-destructing data transmission: a mechanism where an encrypted message or credential is permanently destroyed on the server immediately after it is accessed.

The Digital Self-Destruction Lifecycle

When you create a burn-after-reading secret, your browser encrypts the text with AES-256-GCM and sends the encrypted ciphertext to the database. When the recipient opens the link, the server returns the ciphertext and immediately deletes the database row. The recipient's browser decrypts and displays the plaintext once. Any subsequent attempt to open the link results in a 410 Gone error.

Understanding Related Ephemeral Terms

While often used interchangeably, these terms describe different aspects of digital data lifecycles:

One-Time Secret Link

A single-use web link where access is restricted to exactly 1 view. Opening the link triggers the automatic server purge.

Expiring Link (TTL)

A link governed by a time-to-live clock (e.g., 1 hour). The payload is purged once the clock expires, regardless of whether it was opened.

Disappearing Messages

In-app chat messages (in Signal or WhatsApp) that automatically delete from conversation history after a preset timer (e.g., 24 hours).

Burn After Reading

The combined model: single-view consumption, zero-knowledge encryption, and atomic server deletion.

What "Burn After Reading" Does NOT Mean

It is critical to maintain realistic expectations about digital self-destruction:

✓Server copy is destroyed: The service permanently deletes the stored ciphertext from its database. Nobody can access the link again.
⚠Recipient controls the plaintext: Once displayed on the recipient's screen, the recipient could copy, screenshot, or record the text. Digital deletion cannot erase human memory or physical recordings.

Common Real-World Use Cases

Account Reset Passwords & 2FA Recovery Keys

Delivering initial passwords or emergency recovery codes to employees or clients without leaving permanent records in ticket logs.

Private API Tokens & Webhook Secrets

Passing development tokens between engineers without committing keys to chat channels or email threads.

Keypad Codes & Wi-Fi Passwords

Sharing temporary physical access codes or network keys with contractors or houseguests that purge immediately after reading.

Frequently Asked Questions

Create a Burn-After-Reading Secret Link

Encrypt your text client-side with AES-256. Once viewed by your recipient, the encrypted data is permanently erased from the server.