Write your secret
Type or paste anything — passwords, tokens, private notes, credentials. No account required for one-off sharing.
AES-256-GCM · Zero Knowledge
Your secrets, gone on first view.
Encrypted in your browser before it leaves. The decryption key lives in the URL — our servers see only ciphertext. One view, then it's gone.
- AES-256-GCMencrypted in your browser
- #fragmentkey never sent to server
- 1 viewatomic delete, then gone
Sign in free for 3-day and 7-day links.
Go PRO for 30-day and 90-day links and 100 KB secrets.
Too long for your plan — PRO raises the limit to 76,772 characters.
key never sent to server · 1 view max · deleted on read
✓ Encrypted. Ready to share.
Protocol
Encrypted locally
AES-256-GCM runs entirely in your browser. A random 256-bit key is generated and the ciphertext is what's sent to our server — never the plaintext.
browser console
crypto.subtle.encrypt({ name: "AES-GCM" }, key, data)
Key lives in the URL
The decryption key is appended to the link as a URL fragment (#). Browsers never include fragments in HTTP requests, so the key never reaches us.
Destroyed on view
When the recipient clicks Reveal, fetch and delete happen as one atomic operation. The ciphertext is permanently wiped — even concurrent requests can't read it twice.
Security guarantees
We can't read your secrets.
That's the whole point.
True zero-knowledge
The key lives in the URL fragment — never in an HTTP request. Our servers only store an encrypted blob.
Atomic destruction
Read and delete happen as one atomic database operation. No race-condition window, even under concurrent requests.
Verifiable in DevTools
Open the Network tab. You'll see only ciphertext leave your browser. The key never appears in any HTTP payload.
No passwords stored
Sign-in is GitHub or Google only. We never see or store a password — there's nothing to breach.
TTL enforcement
Hard expiry regardless of views. Expired secrets are purged from our infrastructure automatically every hour.
No tracking on secret pages
No analytics, pixels, or embeds on the secret view page. Full recipient privacy.
FAQ
Common questions.
How do I share a password securely?
Paste it into the box above, choose an expiry, and click Create one-time link. It's encrypted in your browser before it ever leaves your device, and the link that comes back is the only way to unlock it — send that link over any channel you trust.
What is a one-time secret link?
A one-time secret link is a URL that reveals a piece of text — a password, API key, or note — exactly once, then permanently deletes it. After the first view, there is nothing left to leak.
Can you read my secret?
No. Encryption and decryption both happen in your browser. The decryption key lives only in the link's URL fragment (after the #), which browsers never send to any server — so we only ever store ciphertext we can't decrypt.
What happens after the secret is viewed?
The first view triggers an atomic database delete: the secret is read and removed in a single operation, so it's gone forever, even under concurrent requests. Any secrets that expire unread are purged automatically every hour.
How long do links last?
As a guest, links last up to 24 hours. Sign in for free with GitHub or Google and links can last up to 7 days.
Is it really free?
Yes — secrets are free with no account required (24-hour expiry, 5 links a day). A free account raises that to 7 days and 25 links a day. PRO ($9/mo or $90/yr) gives 90-day expiry, 100 KB secrets, 200 links a day, and REST API keys. Custom plans are priced by conversation.
Plans
Start free. Upgrade when you outgrow it.
Free
$0with an account
- 7-day expiry
- 10 KB secrets
- 25 links a day
- Dashboard & view alerts
- No API keys
PRO
$9per month
- 90-day expiry
- 100 KB secrets
- 200 links a day
- Dashboard & view alerts
- REST API keys
Custom
Let's talkbuilt around your company
- Everything in PRO
- Dedicated subdomain
- SSO / SAML sign-in
- Limits set to your needs
- Direct support channel
Coming next: file secrets · CLI tool · more delivery channels