Changelog

News

What's shipping, what's changing, and what you should know about SecretOnce.dev.

Feature

SecretOnce is now an npm package and a CLI

npm install secretonce gives you the same zero-knowledge link from your own code — Node, Deno, Bun, edge runtimes, or the browser — with zero dependencies and no build step. There's a secretonce command too, so echo "$PASSWORD" | secretonce --ttl 1h prints a one-time link straight from your shell or CI, without the password touching your history. The encryption still happens entirely on your side: the key never reaches us, exactly as on the website. There's a new Tools section for it, alongside a full REST API reference for everyone who isn't writing JavaScript.

Product

Daily link allowances replace active-link caps

Your plan now limits how many links you create per day rather than how many can be open at once: 5 a day as a guest, 25 with a free account, 200 on PRO, resetting at midnight UTC. Nothing you've already shared is affected. The pricing page also got clearer — you can switch between monthly and yearly before you sign in, and see which plan you're on.

Product

Every expiry option is now on the homepage

PRO's 30-day and 90-day links are selectable directly from the create form instead of being API-only, the character counter now shows your plan's real limit, and the dashboard tells you how many of your active links you've used. There's also a proper Guest / Free / PRO / Teams comparison so you can see what each plan gets you.

Product

New premium look

SecretOnce.dev has a new dark, focused visual design — same product, same zero-knowledge guarantees, clearer interface.

Feature

PRO plans are live — 90-day expiry, bigger secrets, API keys

PRO is out: $9/month or $90/year. It raises limits to 90-day link expiry, 100 KB secrets, and 500 active links, and unlocks REST API keys for programmatic secret creation with a Bearer token. Upgrade from the dashboard's Billing tab.

Launch

SecretOnce.dev is live

One-time secret links with client-side AES-256-GCM encryption from day one: the decryption key lives only in the URL fragment, the server stores only ciphertext, and the first view triggers an atomic delete. Free, no account required, with a signed-in dashboard to track and revoke links, and bot-guarded reveal links so link-preview crawlers can't burn a secret.