When developers need to send an AWS secret key, database password, or private credential to a teammate, they often resort to chat apps or emails where the secret persists indefinitely in chat logs, notification backups, and cloud servers. OneBurn was built to solve this with mathematical certainty: the secret is encrypted on the sender's device, stored ephemerally, and destroyed upon first retrieval.
Client-Side Encryption (The Zero-Knowledge Principle)
Many online 'pastebins' encrypt secrets on their server. This requires trusting the server operator. If their database is breached or their logs are scraped, the secrets are exposed.
OneBurn uses the browser's native Web Crypto API to generate an ephemeral 256-bit AES-GCM encryption key. The secret is encrypted entirely in the sender's browser. The decryption key is appended to the share link as a URL fragment identifier (#key).
URL fragments (#) are strictly client-side: RFC standards dictate that browsers NEVER transmit the fragment part of a URL to the server in HTTP request headers. Thus, the OneBurn server NEVER sees the decryption key.
Atomic Destruction via Redis Lua Scripts
When the recipient clicks the link, the server must fetch the ciphertext and delete it atomically so race conditions cannot allow multiple reads.
// Redis Lua Script: Fetch and atomically burn in one atomic tick
const burnScript = `
local val = redis.call('GET', KEYS[1])
if val then
redis.call('DEL', KEYS[1])
return val
else
return nil
end
`;
async function fetchAndBurn(secretId) {
const cipherText = await redis.eval(burnScript, 1, `secret:${secretId}`);
if (!cipherText) {
throw new Error('Secret has already been burned or expired.');
}
return cipherText;
}