Frequently Asked Questions

What is Pass Note for?

Pass Note is for sending a password, recovery code, private message, or other sensitive text when the available delivery channel is not a good permanent home for the secret. Instead of putting the secret itself in email, SMS, Slack, or another chat system, you send a single-use Pass Note link.

How does a one-time link work?

Enter the text, choose an expiration, and press Pass! The service generates a fresh encryption key for that note, encrypts the text, and stores only the ciphertext with its expiration. The note identifier and its unique key are wrapped into the share token; the per-note key is not retained as a separate server-side record.

When the recipient opens the link in a normal browser, JavaScript sends an explicit POST request to retrieve it. The service atomically removes the ciphertext before returning the decrypted note. A second request therefore cannot retrieve the same note.

Will a link preview consume the note?

New share tokens are placed in the URL fragment, which browsers do not send in the initial page request. Known preview and crawler user agents receive a non-interactive copy of the homepage with no retrieval JavaScript. The retrieval API also rejects known preview agents before attempting to consume a note. These controls cover common preview clients, but a custom client that impersonates a normal browser can still open and consume a bearer link.

How long is a note retained?

Until its first successful retrieval or its selected expiration, whichever comes first. Expirations can be set up to 28 days. An expired note is never returned; expired ciphertext is also eligible for DynamoDB's background time-to-live cleanup.

What can I send?

Pass Note accepts text. The practical size limit is constrained by the web request and encrypted payload limits of the service. Use a purpose-built encrypted file-transfer service for large files or binary data.

Is this end-to-end encryption?

No. Your browser sends the note to the Pass Note backend over HTTPS, and the backend encrypts it before storage. Pass Note is designed to avoid retaining the plaintext or a separately stored per-note key, but the service necessarily handles plaintext while creating and retrieving a note. See the security model for the exact guarantees and limitations.

What information is retained about me?

No account is required. Encrypted note data is temporary, and application logs use a SHA-256 fingerprint when a share token must be correlated for troubleshooting rather than recording the token itself. Infrastructure providers still process ordinary request metadata. Details are in the privacy notice.

Are there ads or analytics?

Pass Note currently loads no advertising or analytics scripts. The layout reserves room for a possible future banner, but no ad is served there today.

How can I report a security concern?

Email jimmy@passnote.io with enough detail to reproduce the issue. Do not include real secrets or an active share link in the report.