One-time secret
A link that self-destructs after one view. Encrypted before it leaves the tab.
Nothing you enter is sent anywhere
Expires after
Encrypted here, in this tab. The key goes in the part of the link after the #, which browsers never send to a server, so what gets stored cannot be read by whoever stores it.
AES-256-GCM with a fresh key per secret. The server stores ciphertext and a countdown and never receives the key, so it cannot read what it holds. Burn-after-read deletes before the response is sent, so a second reader gets nothing even if two requests race.