How to share private notes safely
A practical guide to one-time links, separate PINs, expiry, and the limits of disappearing messages.
1. Decide what should be shared
A one-time note is useful for a temporary message you do not want left in a chat history. Share only what the recipient needs. For a service that supports individual accounts or delegated access, use those features rather than sharing a permanent master password. A disappearing note does not make unnecessary disclosure safe.
2. Choose a short expiry
OneReadNote offers 1 hour, 24 hours, or 7 days. Choose the shortest window that gives your recipient enough time. The note disappears after its first successful retrieval or after expiry, whichever comes first. If plans change, use the sender receipt to delete it early. Keep that receipt open; there is no account-based history to return to.
3. Separate the link and PIN
The complete link contains a secret after the # character. Treat it as sensitive, even when a PIN is set. A PIN adds a second requirement for opening the note. Choose 6–12 unpredictable digits, avoiding birthdays and common sequences. Send the PIN through a different trusted channel, such as a call, rather than alongside the link in the same message. Confirm you are talking to the intended person.
4. Open when you are ready
Visiting the link shows a confirmation screen and does not read the message. Enter the PIN if requested, then choose to reveal the note. Wrong PINs leave it sealed, but repeated attempts are rate-limited. Once opened, keep the page available until you are finished. Refreshing or closing clears your view. If the connection fails after the server removes the record, the sender must create a new note.
5. Understand what deletion cannot do
One-time reading prevents a second retrieval from the app; it does not stop screenshots, photographs, or copying. Infrastructure backups can retain encrypted remnants. Browser extensions or a compromised device can also expose a message. Use a device and browser you trust. If you shared a temporary credential, revoke or rotate it when the task is finished. Read our privacy page for the complete limitations.