I needed to send someone a password last month. Not a hard problem, except every option felt wrong. Slack keeps it forever. Email keeps it forever and hands a copy to two mail servers on the way. A text message ends up in somebody's phone backup. The password was going to outlive the reason I sent it.

So I built Lockerr. Paste a secret, get one link, and the moment someone opens it the note is gone.

What's Lockerr

It's one page. Paste the thing you need to send, pick a password, and you get a link back. Send the link to the person who needs it, then send the password some other way. A phone call is fine. They open the link, type the password, and read the note once.

If they refresh, there is nothing there. If someone digs the link out of a chat log next week, there is nothing there for them either. Most sharing tools are built so a message stays available. This one is built so it stops existing.

Why I Built It

Tools like this already exist, and I used one for years. What kept nagging at me is that I never actually knew what happened on the other side of the request. For a product whose entire value is "trust me, it's gone," that gap eventually felt like the whole thing.

There's a smaller and more honest reason too. I wanted a project where getting it slightly wrong actually mattered. If a booking form has a bug, someone reserves the wrong court on a Tuesday. If this has a bug, someone's production credentials sit in a database long after they were told the note was destroyed. That pressure made me slow down and think properly about failure cases, which is usually the part I rush.

How It's Built

Your note is encrypted in the browser before anything leaves your machine. The server only ever receives a blob it has no way to open, so I cannot read your notes even if I wanted to, and neither can anyone who walks off with the database.

The key that unlocks it is split in half. One half lives in the part of the link after the #, which browsers never send to a server. The other half comes from the password you picked. Both halves get folded into a single key rather than stacked as two layers, and that detail took me longer to get right than anything else in the project. Nest them, and somebody holding a copy of the database can sit offline testing password guesses until one works. Combining them takes that away.

Destroying the note is one statement:

UPDATE notes SET view_count = view_count + 1
WHERE id = ?1 AND expires_at > ?2 AND view_count < max_views
RETURNING ...

One statement, one winner. Two people clicking the same link in the same second cannot both come away with the note, because the database settles it rather than my code. There is a test that fires eight requests at once to prove it.

The whole thing runs as one small program on Cloudflare's network, with a cleanup job every hour that clears out whatever nobody claimed. Nothing renders on the server, because nothing on the server is readable anyway.

One caveat worth saying out loud, since it tends to get glossed over: the page doing the encrypting is served by me, and a compromised deploy could change it. That is true of every browser-delivered encrypted tool, and it is exactly why the code is public. You don't have to take my word for what it does.