Share a password with a one-time secret link
Send a password with an encrypted link that opens only once and self-destructs after a countdown. The encryption happens in your browser.
A rail joins two desks. A locked capsule leaves the desk where the note is written, passes under a gatehouse with a lamp and reaches the other desk, where the note appears next to a shredder. Then the capsule fades away. Enter, Space or the arrow keys move from one step to the next.
How to use it
- Type or paste the password or text you want to send.
- Choose when the link expires and how long the secret stays visible once opened.
- Click “Create secret link”, copy the link and send it through whichever channel you prefer.
- The recipient clicks “Reveal the secret”: it is deleted from the server and the countdown starts.
Frequently asked questions
Can you read the password I send?
No. It is encrypted in your browser with 256-bit AES-GCM and the key travels in the part of the link after “#”, which browsers never send to the server. We store the encrypted text, a check for the key and when it expires.
What happens when someone opens the link?
When they click “Reveal the secret”, the encrypted text is deleted from the server at that moment and decrypted in their browser. A countdown starts, which they can extend if they need more time, and when it ends the secret disappears from the page.
What if nobody opens the link?
It expires after the time you choose (one hour, one day or seven days) and the encrypted text is deleted. After that the link opens nothing.
Is there a limit on links?
Yes, to prevent abuse: 30 per hour and 100 per day from the same connection. To count them, an irreversible fingerprint of your IP address is kept for 48 hours at most.
How do I know if someone else opened it first?
If the recipient sees “This secret no longer exists”, someone opened it before them or it has expired. In that case, treat the password as compromised and change it.
Is it better than sending it by email or chat?
Yes: the password is not left in the chat history or in anyone’s inbox. Someone who intercepts the link before the recipient can open it, but then the recipient will know.
Why not send passwords by email or chat
A message containing a password does not disappear when the recipient reads it. It stays in both people’s history, in backups, on every device where either of them is signed in and, at work, in the company’s archives. Months later, anyone who gets into any of those places finds it with a search.
A one-time link leaves something in the chat that is no longer good for anything: once it has been opened, the secret has been deleted. And if someone gets there before the recipient, the recipient will know, because on opening it they will see that the secret no longer exists.
How the encryption works
The text is encrypted in your browser with 256-bit AES-GCM before it leaves your device. The key is generated at random and goes in the part of the link after “#”, the fragment, which browsers never send to the server. The server stores the encrypted text but not the key: without the full link nobody can read it, and neither can we.
When the recipient clicks “Reveal the secret”, the server hands over the encrypted text and deletes it in the same operation; the decryption happens in their browser. If nobody opens it, it is deleted when the time you chose runs out.
Tips for sharing a secret
Send the link through one channel and say what it is for through another: the link by email and “it is the office Wi-Fi password” over the phone, for example. That way, whoever intercepts one of the two does not have the full picture.
Choose the shortest expiry that still gives the recipient time to open it. And if it is a password you can change, ask them to replace it with one of their own as soon as they are in: the one you sent then stops being worth anything.
