Btwinus vs Privnote: which one should you use to share a secret?

People search for "Privnote alternative" for two very different reasons. Some want the same one-shot note with fewer ads or cleaner crypto. Others want something that doesn't store their secret on anyone's server, even for a minute. Btwinus only answers the second group, and this post tries to be honest about that.

What Privnote is

Privnote is a free website. You type a note, click a button, and get a link. The recipient opens the link, reads the note, and Privnote deletes it. No account on either side, nothing to install.

Under the hood, the note is encrypted in your browser before upload. The decryption key is placed in the URL fragment, the part after the #: which browsers never send to a server. So Privnote's servers hold the ciphertext and (in principle) never see the key. You can optionally add a manual password, set a time-based expiry so an unopened note still dies, and ask for an email when the note is read.

Two things to know. First, Privnote is closed source: the JavaScript is inspectable in your browser, but there's no published repository, so you take the deletion and key-handling claims on trust. Third-party writeups have reported that it uses an old AES-CBC library with MD5 key derivation; we couldn't confirm that independently, so treat it as a claim rather than a fact. Second, the site is ad-supported and loads third-party tracking scripts, and it has been repeatedly impersonated by look-alike domains (privnotes.com, privnote.co) that quietly rewrite crypto addresses in notes. If you use it, bookmark the real domain.

What Btwinus is

Btwinus is a live one-to-one chat that runs entirely in two browser tabs. You click "Start a new chat" and get two things: an invite link and a passphrase like storm-fox-river-4821. The link carries an encrypted WebRTC offer in its URL fragment, encrypted with AES-256-GCM, with the key derived from the passphrase using PBKDF2 (100,000 iterations). You send the link through one channel and the passphrase through a different one. The other person opens the link, types the passphrase, and sends you back a reply link. Once you paste it, the two browsers connect directly over WebRTC and you're chatting.

There is no server in that loop. Nothing is uploaded, nothing is stored, nothing can be subpoenaed. When either tab closes, the conversation is gone. A short authentication string is shown on both sides so you can read it aloud and confirm nobody sat in the middle of the handshake. Btwinus is free and open source. (Here's the full explanation of how the link carries the encryption.)

The cost of "no server" is real: both of you must be online at the same time, it's strictly two people, and it's text only, there's no file transfer.

The honest comparison table

Property	Privnote	Btwinus
Shape	One-shot note	Live chat
Account required	None	None
Where the secret lives	Privnote's servers (encrypted) until read or expired	Nowhere, travels browser to browser
Encryption	Client-side, key in URL fragment	AES-256-GCM, PBKDF2 from a passphrase, key never in the link
Second factor	Optional manual password	Passphrase always required, sent out of band
Recipient can be offline	Yes	No, both online at once
Two-way conversation	No	Yes
Groups	No	No
Files	Text only	Text only
Open source	No	Yes
Self-hostable	No	Yes, it's a static page
Ads / trackers	Yes	None
Cost	Free	Free

Where Privnote is the better choice

The recipient isn't around. This is the big one. A Privnote link sits on their server for as long as you set, and the other person opens it whenever they get to it. Btwinus needs a live handshake: if your colleague is asleep in another time zone, you're waiting.

You want one link and nothing else. A Privnote note is a single URL. With Btwinus there's a link and a passphrase and a reply link coming back, and a non-technical recipient has to follow that. It's one more step than "click here".

You're pasting into a form field, not talking. A Wi-Fi password, a door code, a tracking number. There's no conversation to have; a note is the right shape.

You want read receipts. Privnote can email you when a note is opened. Btwinus has no notifications because there's nothing to send them.

Where Btwinus is the better choice

You don't want the secret on anyone's server, even encrypted. Privnote's promise is "we can't read it and we delete it." Both are plausible, and neither is verifiable from the outside. Btwinus sidesteps the question: there's no upload, so there's nothing to trust.

A single intercepted link must not be enough. A plain Privnote link is the whole secret: whoever gets the URL gets the note. (Its optional password fixes this, but it's off by default.) In Btwinus the passphrase is mandatory and never travels in the link, so an attacker who reads your email or your Slack still has only half. (This two-channel idea is the core of how to share a password without leaving a copy behind.)

You need a back-and-forth. "Here's the key, which environment?, staging, okay, and the username?" A note can't do that. A chat can, and closes without a trace.

You want to verify who you're talking to. Btwinus shows both sides a short code to compare out loud. A note has no equivalent; you find out it went to the wrong person only if it did.

You want to read the code. Btwinus is a few hundred lines of vanilla JavaScript on GitHub. Privnote's stack is private.

You'd rather not feed an ad network. Btwinus has no ads and no trackers beyond a consent-gated analytics tag on the landing page, none on the chat itself.

How to decide

• Recipient offline, low-stakes secret, one link only → Privnote (with a manual password, from the bookmarked real domain).
• Recipient available now, high-stakes secret, or you need a conversation → Btwinus.
• You can't tolerate a server holding the ciphertext, even briefly → Btwinus.
• You need groups or files → neither; look at Signal or a shared password manager.
• It's a seed phrase or a master password → don't send it digitally at all.

The short version: Privnote is a mailbox that burns its contents; Btwinus is a room with no walls that vanishes when you leave. Use the mailbox when the other person isn't there. Use the room when they are and it matters.