one-time secret links

Share a password, token or note with a link that opens once. Encrypted in your browser before it's sent; deleted after the first view.

0 / 98,000
Ctrl Enter
how this works
  1. Your browser encrypts the text with a fresh random AES-128-GCM key.
  2. Only the ciphertext is uploaded. The key stays in the link after #, which browsers never send to a server.
  3. Pressing reveal downloads the ciphertext and deletes it on the server in the same request.
  4. Secrets nobody opens are deleted when they expire.

share a password once

Paste a password, API key or private note and get a self-destructing link. The first person to press reveal sees the text; the server deletes it in the same request. Unopened links expire after 1 hour, 1 day or 7 days. No account, no cookies, no third-party scripts.

faq

Can the server read my secret?

No. Your browser encrypts it with AES-128-GCM and a random key made for that one secret. The key is in the link after #, which browsers never send to a server, so the server only stores ciphertext it can't decrypt.

Will a Slack, Telegram or Teams link preview use it up?

No. Previews only load the page. Only the reveal button downloads and deletes the secret.

How long does a secret last?

Until it's revealed, or until it expires after 1 hour, 1 day or 7 days, whichever comes first. Then it's deleted.

What if someone else opened it first?

The link says it was already opened. Treat the secret as exposed: ask the sender to change the password and send a new link.

How much can I send?

About 98 KB of text: passwords, keys, config snippets, notes. Files aren't supported.