Explainer
Why chat apps burn one-time links before your friend opens them
WhatsApp, Slack, iMessage, Telegram, Discord and email security scanners open links the moment they’re shared. Here is why that destroys “view once” notes, and how to avoid it.
You send someone a “view once” note. A minute later they reply: “It says the message has already been read.” Nobody else had the link. Nobody opened it. Except something did: the app you used to send it.
This is one of the most common complaints about self-destructing notes, and it isn’t a bug in any one service. It’s how link previews work.
What a link preview actually does
When you paste a link into a chat, most apps show a small card with the page’s title, a description and often an image. To build that card, something has to download the page and read those details from it. There are two ways apps do this:
- From the sender’s device. Your phone fetches the page before the message is sent and attaches the preview to it.
- From the app’s servers. The app’s own computers fetch the page, usually as soon as the link is posted, and sometimes again later.
Either way, the page gets a visit before the person you sent it to has touched it.
| App | Who fetches the link | Notes |
|---|---|---|
| The sender’s phone | Previews can be switched off in the privacy settings | |
| iMessage | The sender’s device | The preview travels with the message |
| Signal | The sender’s device, through a privacy proxy | Only when link previews are switched on |
| Telegram | Telegram’s servers | Identifies itself as “TelegramBot (like TwitterBot)” |
| Slack | Slack’s servers | Identifies itself as “Slackbot-LinkExpanding” |
| Discord | Discord’s servers | Identifies itself as “Discordbot” |
| Work email | Security scanners | Many company mail systems visit links to check them for malware, often posing as a normal browser |
Why that destroys a one-time note
A one-time note is simple: the first time the page is opened, it shows the text and deletes it. The service can’t tell who is opening it. A visit is a visit. So when a preview fetcher or an email scanner opens the link first, it gets the one read. Your recipient arrives second and finds an empty page.
It gets worse with email. Company security tools often scan every link in incoming mail, and to avoid being blocked they frequently identify themselves as an ordinary Chrome or Edge browser. A site can’t reliably filter them out by name.
Three ways services deal with it
1. Ask a person to confirm
The page the link opens doesn’t contain the note. It says something like “this note will self-destruct” and waits for a button press. Link previews and scanners load the page but don’t press buttons, so the note survives. Privnote asks for confirmation by default, and TxtVanish always does for self-destructing messages.
2. Delete only after the note is decrypted in the browser
Tools that decrypt in the browser, like PrivateBin, can wait until the browser has actually shown the note before telling the server to delete it. A preview fetcher never runs that code, so it never triggers the deletion.
3. Guess who is a robot
Some services check the visitor’s “user agent”, the name a browser or bot sends with every request, and ignore known preview bots. It helps with Slack or Telegram, which name themselves honestly. It fails with anything that pretends to be a normal browser, which is exactly what many email scanners do.
How TxtVanish handles it
- Opening the link never shows the message. For self-destructing messages, the first page only says it will self-destruct and how many views are left.
- A view is counted only when a person presses “Show message”. That sends a separate request that previews and scanners don’t make.
- Previews get a neutral card. Chat apps see “A private message for you”, never a line of your text.
- The sender can check without spending the view. The private sender link shows whether and when the message was opened.
You can try it: create a self-destructing message, paste the link into a chat with yourself, and watch the preview appear while the message stays unopened.
What you can do on any service
- Don’t test the link yourself. Opening it, even just to check, uses the view on most services.
- Remove the preview before sending where the app allows it. WhatsApp lets you close the preview card, and has a setting to switch previews off.
- Be careful with email. If your recipient’s company scans links, a note that burns on first load may be gone before they see it. Use a service with a confirmation step.
- Add a password for anything sensitive, and send it by another route. Even if something else opens the link, it can’t read the message without the password.