burnerpad/burnerpad-lite

Burnerpad is a simple, no accounts tool for sharing a secret one time. You paste text you want to send, like a password or a private note, and the tool gives you a link. When the person you send it to opens that link, the secret is shown once and then destroyed. There is no account to create and nothing is saved to a database. The encryption happens in your browser before anything is sent, so the server never sees the plain text of what you shared. The key needed to unlock the secret never reaches the server either. Everything is kept only in memory while the app runs, with a countdown until it expires automatically, and it disappears completely if the server restarts. The project is built with Elixir and a small web library called Bandit, with no database and no JavaScript framework. The browser side uses a few small handwritten scripts plus a separate, audited encryption library that is pulled in as a pinned dependency. To run it yourself you need Elixir 1.18 or newer, and you can start it for development, package it for production, or run it in Docker. Since it only serves plain HTTP, you would put something like Caddy in front of it to add HTTPS. There is a small API for creating and retrieving secrets by script, plus a public status page showing overall usage numbers like how many secrets are currently stored, without revealing anything about individual secrets. A terms and acceptable use page is included too, filled in with the operator's name and contact details through environment variables, so anyone running their own copy needs to update those settings and should have a lawyer check the wording before using it publicly. Testing includes an Elixir test suite along with checks for the browser encryption code, and an optional browser based test that walks through a real user flow. The whole project is small by design: one main dependency, no accounts, no persistence beyond a short lived timer. The code is licensed under AGPL 3.0 or later, while the separate crypto library it depends on uses the more permissive Apache 2.0 license.