Whisprlink shares a secret through a link — without the server ever being able to read it. This is called zero-knowledge: even the people running the service can't see your data, because it's encrypted before it leaves your device.
AES-256-GCM. Nothing has left your device yet.# — the URL fragment. By web standard, browsers never send the fragment to the server. So the key travels with the link, not through our servers.#, and decrypts locally. If burn-after-reading is on, the server deletes the ciphertext the moment it's fetched.It sees: an opaque blob of ciphertext, its size, an expiry timestamp, and whether it's burn-on-read. It cannot see: your plaintext, the encryption key, the filename, or anything about the content.
When enabled, the secret is deleted the instant it's first fetched — before the response is even sent back. It can be read exactly once. If someone intercepts the link and opens it first, the intended recipient gets a "this secret is gone" page — which is itself a signal that something's wrong.
Every secret carries a hard expiry (10 minutes to a week). After that, it's treated as gone and cleaned up. Nothing lives forever.
Zero-knowledge protects the content, not the fact that you shared something. Anyone with the full link can read the secret — so share it over a channel you trust, and prefer burn-after-reading. And like any web app, you're trusting that the code served to your browser is the code described here; the encryption is only as good as the page that runs it.