Last Word

Live: https://lastword.alexe6573.workers.dev

A note that exists exactly once. Write it, share a link; when it's read, it stops existing.

• AES-GCM-256 encryption in the browser. The key lives only in the link fragment (#k=...), which browsers never send to servers.
• The first deliberate read deletes the row mid-request: DELETE ... RETURNING, atomically. Twenty simultaneous readers, exactly one winner. The database is the referee (scripts/race-test.sh).
• Reading is POST-only, so link-preview crawlers can never burn a note.
• No accounts, no email, no logs (platform request logging is switched off too), no analytics, no third-party runtime requests. The server stores ciphertext, an IV, and timestamps. Nothing else.
• Once a note is gone, only a tombstone remains: an id, a time, and whether it was read or expired. Never the words. Tombstones are purged after 30 days.

Stack

Cloudflare Worker + Hono (API) · D1 (SQLite) · Vite + React + TypeScript + Tailwind (SPA). Fonts self-hosted. CSP locked to default-src 'none' plus the same-origin minimums.

Develop

npm install
npx wrangler d1 execute lastword --local --file schema.sql
npm run build
npm run dev:worker        # http://127.0.0.1:8787
npm run check             # typecheck client + worker
./scripts/race-test.sh    # twenty simultaneous readers: exactly one 200, the rest 410

Deploy

npx wrangler login
npx wrangler d1 create lastword          # paste the database_id it prints into wrangler.toml
npx wrangler d1 execute lastword --remote --file schema.sql
npm run deploy

Runs on the Cloudflare free tier. There are no secrets to configure: the worker holds none.

Built solo by Alex Evoy for Hackyard Yard #1 ("No accounts"), August 2026.