Is Privnote Safe? 3 Risks Before You Paste a Password

Is Privnote safe? For a casual note between friends, yes. For a password, an [API key](/glossary#api-key "Glossary: api key") or anything a business cares about, no. The one-view mechanism works; the risks are everything around it. There are three, and the first one has cost real people real money.

Updated 2 October 2026: added what we could verify about Privnote's encryption library from its live page source, the 2024 clone network documented by Krebs on Security, and corrected an earlier statement about LinkPilot's encryption. Where this post says "we checked", the check date is 2 October 2026.

This post is the safety verdict. If you already know you want something else, the best Privnote alternatives roundup compares seven tools on encryption, revocation, audit logs and price, and LinkPilot vs Privnote is the head-to-head for our own product.

What does Privnote do well?

Credit where it is due. The core product is genuinely convenient: no account, paste a note, get a link, the note is destroyed after it is read. Privnote's own page says the note is "encrypted in your browser and then stored in Privnote", offers a "manual password" to encrypt the note, expiry windows of 1 hour, 24 hours, 7 days or 30 days, an e-mail notification when the note is destroyed, and the sensible advice to send the password by "a different method" than the link.^[1] For "here's the Wi-Fi key, delete after reading" between people who trust each other, it is fine.

What are the 3 risks?

1. Clone-site phishing that reads your note

Privnote's brand recognition has spawned lookalike domains, and the best-documented ones were built to steal.

In June 2020, Brian Krebs reported that privnotes.com (plural) imitated Privnote, did not actually encrypt notes, and ran a script that detected bitcoin addresses in a note and replaced them with the scammers' own, but only when the sender and the recipient opened the note from different IP addresses, so the sender checking their own note never saw the swap.^[2] In April 2024 he documented a whole network of clones, including privnote[.]co, tornote[.]io, privatenote[.]io, pirvnota[.]com, privatemessage[.]net, privnode[.]com and privnate[.]com, that "function more or less as advertised but also quietly inject their own cryptocurrency payment addresses when a note is created that contains crypto wallets". Four addresses tied to one of those sites took in nearly $18,000 in four days, and the operators rotated in new addresses roughly every five days.^[3]

The danger is not the real site. It is that a search-result or ad click can land you on a convincing fake whose entire purpose is reading your secret. If you use Privnote, type the domain yourself. A link-reputation check like our free link trust score tool can sanity-check a suspicious URL before you paste anything into it.

2. Encryption you cannot verify

Privnote says notes are encrypted so the server cannot read them; in 2020 the company told Krebs that real Privnote uses encryption "so that even Privnote itself cannot read the contents".^[2] That may well be true. But the code is closed source, so nobody outside the company can confirm it, and what can be seen from the outside is not reassuring.

Here is exactly what we could and could not verify on 2 October 2026:

• Verified: the live privnote.com page loads a JavaScript file named gibberish-aes.js from its static assets.^[1]
• Verified: the upstream Gibberish-AES project on GitHub was archived (made read-only) on 16 October 2018. Its own README says it "only supports CBC AES encryption mode", is built to be compatible with OpenSSL's MD5-based key derivation, and carries a deprecation note recommending libsodium or Stanford's JavaScript Crypto Library instead because Gibberish-AES "is quite old, and uses an older and non-authenticated cipher mode, CBC".^[4]
• Not verified: we did not reverse-engineer Privnote's minified application code to confirm that this library is the code path that encrypts a new note today, as opposed to a legacy path for old notes. Treat the finding as "the only crypto library the page ships", not as proof of what runs.

Contrast that with tools whose source you can read: PrivateBin documents 256-bit AES in Galois Counter Mode (an authenticated mode) run in the browser with the key in the URL fragment,^[5] and Yopass encrypts in the browser with OpenPGP under an Apache-2.0 licence.^[6] For a secrecy tool, "trust us" is a materially weaker position than "check for yourself".

3. No way to undo a mistake

Sent the note to the wrong person? There is no dashboard to revoke it. Need to prove to a client that a credential was never opened? There is no audit trail: the destruction e-mail tells you the note was read, not by whom or from where. Wondering whether it was read by the intended recipient or by an e-mail security gateway that fetched the link? You cannot tell. None of this matters for casual notes; all of it matters at work.

What should you use instead?

The full seven-tool comparison, with a pricing table and each vendor's pricing page cited, is in best Privnote alternatives. For our own product against Privnote feature by feature, including the honest caveat that LinkPilot is hosted-only and closed source, see LinkPilot vs Privnote.

Correction history: the first version of this post said LinkPilot did not claim to encrypt in the browser. Since 29 September 2026 it encrypts text payloads and attachments in the browser, with the key in the URL fragment; secrets created before that date were stored as plaintext until they expired. Here is exactly what it claims.

How do you use any one-time note tool safely?

1. Type the domain yourself. Never reach a secrets tool through ads or search results; that is the clone-site attack in one line.
2. Add a passphrase and send it through a different channel than the link.
3. Set the shortest workable expiry so unopened notes die on their own.
4. Rotate the secret if anything looks off. A burned-before-read status, or a destruction e-mail before the recipient opened it, is your early warning that someone else did.
5. Never put the password itself in e-mail or chat, only the link. Our secure password sharing guide compares the five ways teams share credentials and why that rule matters.

The one-view mechanism is a genuinely good idea, which is why so many tools implement it. The safety question is everything around the mechanism: who runs it, whether you can verify it, and what you can do when something goes wrong. Judge Privnote, and every alternative, ours included, on those three questions.

References

[1] Privnote. Home page and page source (checked 2 October 2026). https://privnote.com/

[2] Krebs, B. (14 June 2020). Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com. Krebs on Security. https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/

[3] Krebs, B. (4 April 2024). Fake Lawsuit Threat Exposes Privnote Phishing Sites. Krebs on Security. https://krebsonsecurity.com/2024/04/fake-lawsuit-threat-exposes-privnote-phishing-sites/

[4] mdp/gibberish-aes. A fully OpenSSL compliant javascript library for AES encryption (repository archived 16 October 2018). GitHub. https://github.com/mdp/gibberish-aes

[5] PrivateBin/PrivateBin. A minimalist, open source online pastebin where the server has zero knowledge of pasted data. GitHub. https://github.com/PrivateBin/PrivateBin

[6] jhaals/yopass. Secure sharing of secrets, passwords and files. GitHub. https://github.com/jhaals/yopass