How it works

A burn bag is where classified paper waits to be destroyed. This is the version for a voice note, a short video, or a few paragraphs.

1. You record or type in your browser. The message is encrypted there, with a key built from two halves and your PIN.
2. One half of the key goes into the link, after the #. Browsers never send that part to a server.
3. The other half, plus the encrypted message, goes to the locker. The locker also keeps a hash of the PIN.
4. The recipient opens the link and enters the PIN. The locker checks the PIN (five wrong tries and it destroys the message), then hands over its half and the ciphertext once, deleting both in the same database transaction.
5. The recipient's browser combines the two halves, decrypts, plays or shows it, and discards. With the server's half gone, nothing on earth can decrypt that message again — not the link, not a backup, not a subpoena.

What it does not protect against

• Whoever presents the link and PIN first gets the message. Send them by different routes.
• The listener can record what they hear. That is true of every message ever sent.
• A compromised browser on either end. Encryption happens there.
• The server learns the PIN at seal and claim time, and knows when a message was sealed and played. It never has a complete key.

Keys: HKDF-SHA256 over both halves, salted with the message id, PIN in the info string → AES-256-GCM. PIN hashed server-side with Argon2id. All standard, all in the browser's own WebCrypto.