Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)

I think the most important point is, that this solution requires a way to securely transmit the generated link. As described in another comment by @ryandvm this has two advantages over transmitting the password directly: 1. It won't show up in logs or be otherwise accidentally stored. 2. If the link expires after a single use you get security in the covert model. However, this comes with problems because some tools like virus scanners automatically hit links.

Exactly exactly. I made sure to be resilient to Google bots/Virus Scanners by doing some fancy javascript tricks

For this reason I host all the JS/CSS myself and don't have any other JS running. I.e. no google analytics or ad shit.

It is secure. The password is not sent to my service. Try setup an `netcat -l -p 8000` and go into your browser and write `http://localhost:8000/#hi` You will see the hi is never sent to the server

It's insecure because anyone who intercepts the message can trivially decrypt it by pasting it into their browser.

Yes, self-destructing messages are more secure than simply pasting plain text. But it's offering no protection against eavesdropping, so it's not secure.

At least you'd know the message has been compromised, no? Although I guess a perp can feed you a different link and delay the realization.

It's not a perfect solution. As @dfalfndfk says you will know that you're eavesdropped.