Msg Review 2026: Encrypted One-Time Messages

Msg, also called Crypto Message on its homepage, is a web service for sharing one-time encrypted messages. A sender creates a message and receives a link for the recipient. The service says no account is needed and describes itself as free and open source.

Msg says encryption and decryption happen in the browser, with the key kept in the link's URL fragment rather than stored on its servers. It also says messages are deleted after they are read or reach their expiration time. The homepage does not publish an independent audit, detailed deletion procedures, or team information.

A sender writes a message in the browser and asks Msg to create an encrypted link. The homepage says encryption uses AES-256-CBC through the Web Crypto API, with a randomly generated 16-byte initialization vector. The resulting link is unique to the message.

The link includes the decryption key in its URL fragment. Browsers normally do not include URL fragments in HTTP requests, so the key is not sent to the server as part of a standard request. The recipient still needs the complete link to decrypt the message, making the link itself a secret that should be shared carefully. Msg says it deletes messages after they are read or their expiration time is reached.

The service describes itself as free. It does not publish a detailed fee schedule or state whether any features have separate charges; check the service interface for any applicable pricing before use.

Msg describes client-side AES-256-CBC encryption and says its source code is open, but it does not publish an independent security audit. Its homepage does not explain how it protects message integrity or detects tampering, so the encryption algorithm alone should not be treated as proof of secure implementation.

The complete link is sensitive: anyone who obtains it may be able to read the message. The project says it deletes messages after reading or expiration, but its deletion and backup practices are not independently verified in the published description. Avoid using the service for information whose exposure could cause serious harm.

Msg may suit people who want to share a short-lived, low-sensitivity secret through a link without signing up. It is a poor fit for users who need independently audited security, detailed retention guarantees, or a documented process for high-risk communications.