On Fire Media Secret

Self-destructing text

Share a secret that deletes itself.

Paste it below and we hand you back a link. The link burns out after a set number of days or a set number of views, whichever comes first.

The secret
0 / 10,000
Generate a password
(2–8)

How many word chunks get strung together.

Separator

Adds one of % & $ to the end. None of them clash with the separators above.

Preview
Lifetime

Expires after whichever comes first

Days until it expires
days (1–90)
Views until it expires
views (1–100)

Burns out in 7 days or after 5 views, whichever comes first.

Second lock
Optional

The recipient has to type this before the secret is revealed. Send it a different way than the link. A phone call works.

More options

Helps avoid chat systems and link scanners from burning a view.

They get a delete button on the reveal page. Useful when you want proof it is gone.

Bot check

A one-time check from Cloudflare. Your secret is never sent to it.

We encrypt it before it is stored. Nobody at On Fire Media can read it.

How it works

The short version

How is my secret stored?

The link you get back ends in a random token. We derive an encryption key from that token, encrypt your text with it, and store only the ciphertext. The token itself is never written to the database. We store only a hash of it.

So the copy sitting on the server is unreadable without the link you are holding. If you lose the link, we cannot recover the secret. That is the point.

What gets logged?

The time a secret was created, the time each view happened, and the counters that drive expiry. That is what makes “3 views left” possible.

Not logged: the secret, the passphrase, or anything derived from either. Cloudflare sees request metadata the way it does for any site, which is what stops abuse.

What if the link gets opened by a scanner?

Some chat apps and mail gateways fetch every URL they see, which burns a view before your recipient reads anything. Turn on Use a 1-click retrieval step and the link lands on a confirmation page instead. The view is only spent when a human presses the button.

Can I take it back?

Set the views to 1 and the days to 1 if you want the tightest window. If you turned on the recipient delete option, whoever opens it can destroy it on the spot and you will see the view count stop moving.

Otherwise, wait it out. There is no sender dashboard, because a dashboard would mean we kept something that ties you to the secret.

Does the recipient need an account?

No. There are no accounts on this tool at all: not for senders, not for recipients. Anyone with the link (and the passphrase, if you set one) can open it until it expires.