How Privnote encryption protects your note
When you create a Privnote, the note text is encrypted in your browser before anything is uploaded. The random key used for that encryption is appended to the Privnote link after the # fragment marker, and browsers never transmit the fragment to the server. The Privnote server therefore stores ciphertext plus an identifier, and nothing it can decrypt alone.
This design means a database breach at Privnote would expose unreadable blobs rather than your Wi-Fi password. It also means Privnote support genuinely cannot recover a note for you, which is a feature rather than a bug.
Where Privnote security actually breaks down
The mathematics is not the weak point — distribution is. Anyone who obtains the Privnote URL is the reader, because possession of the link equals possession of the key.
- Sending the Privnote link in the same chat you were trying to keep clean
- Link previews: messengers, mail filters and antivirus scanners open the Privnote and burn it
- Shared or corporate devices where the Privnote page stays in browser history
- Fake Privnote clone domains that quietly archive the plaintext
How to send a Privnote securely
Treat the Privnote link and the Privnote password as two separate secrets and move them over two separate channels — for example the link by email and the password by phone call. Enable the read notification so you learn immediately if the note was opened by someone other than your recipient.
Before pasting anything sensitive, verify the domain in the address bar character by character. Privnote phishing clones rely on a hurried glance, not on breaking any cryptography.