Free · No sign-up · Open source

Send secrets online. Once.

Paste a password, an API key or anything private. You get a link that reveals it one time, then the secret is gone for good.

  1. 1Encrypted in your browserAES-256 runs on your device. My server only gets ciphertext.
  2. 2Key never leaves the linkIt sits after the # in the link, which browsers never send.
  3. 3Deleted after one readRevealing it burns it. Unrevealed, it expires on its own.

How it works, and what it can't protect

0 bytes of 10 KB used

Expires if unrevealed in

Share it through a different channel than the link, e.g. say it on a call.

How to send a secret online

  1. STEP 1

    Paste your secret

    A password, an API key, a .env file, recovery codes: any text up to 10 KB.

  2. STEP 2

    Pick an Expiry, add a passphrase if you like

    The link stops working after that time even if nobody opens it. A passphrase adds a second lock you share another way.

  3. STEP 3

    Send the link

    Paste it in Slack, email or a text. Your recipient clicks Reveal, sees the secret once, and it's gone.

Why not just paste it in the chat?

A password pasted into Slack or email stays there: in the history, in backups, in search, on every device that synced it. If any of those leak, so does your secret.

A one-time link leaves nothing behind. The chat keeps a link that no longer works, and the server never had anything it could read.

Questions

How do I send a password securely online?

Paste it in the box above and press Create link. Your browser encrypts it before it leaves the page, and you get a link that reveals it once. Send the link, and if it's important, add a passphrase and tell your recipient over a call.

Can you read the secrets I send?

No. The encryption key lives after the # in the link, and browsers never send that part to a server. I only store ciphertext I can't decrypt. Here's exactly how it works.

What happens after the secret is revealed?

It's burned on the server in the same step that hands it over, so even two clicks at the same moment can't both get it. Anyone who tries the link afterwards is told it's gone.

Will Slack or Teams link previews use up my link?

No. Opening the link doesn't touch the secret: your recipient has to click Reveal. Bots that fetch the page to build a preview never get it.

How long does a link last?

Until it's revealed, or until its Expiry: 1 hour, 1 day, 7 days (1 day by default). After that, the secret is burned unread.

What if someone else opens my link first?

They'd get the secret, and your recipient would see that it's gone, with a note to warn you. For anything that matters, add a passphrase: then the link alone isn't enough.

Is it free? Do I need an account?

Free, no account, no trackers. The code is open source under AGPL-3.0 on GitHub. If it helps you, you can support me on GitHub Sponsors.