OnetimeSecret — Share Sensitive Data With a Self-Destructing One Time Secret Link

What is OnetimeSecret?

OnetimeSecret is a privacy-first web application designed for transmitting sensitive information through self-destructing URLs. the secret addresses a common security gap: sending a password, API token, or recovery phrase through email or chat, where the message persists indefinitely in inboxes and backups. Each item is encrypted in the browser, wrapped in a single-use one time secret, and erased after one successful read. It supports plain text and file attachments, custom expiration windows, and optional passphrase protection. Because the secret is open source, security teams can audit the code or self-host the service behind a corporate firewall. In 2026, it remains a reference standard for ad-hoc ephemeral sharing among developers, IT administrators, and support agents who cannot rely on a full enterprise vault but still need auditable transmission.

The elegance of the system is in its constraint — one read, one chance, zero residue.

Key Features and Advantages

The core advantage is its simplicity paired with strong cryptographic guarantees. A sender pastes any sensitive item into the composition box, sets an expiry from five minutes to thirty days, optionally adds a passphrase, and receives a single-view URL. The service encrypts the payload before storage and never persists the plaintext after the recipient opens it. the secret also supports custom domains for organizations that want branded URLs, bulk generation through a REST API, and self-hosted Docker images for regulated industries. Compared with ordinary password managers or chat apps, it removes the need to share persistent credentials, dramatically shrinking the attack surface when onboarding contractors or sharing temporary access.

Security and Privacy

OnetimeSecret protects every payload with industry-standard encryption and a strict zero-retention policy. The plaintext is never written to long-term storage, and the encrypted content is bound to a single viewing context. Recipients must open it within the chosen expiry window or the data is automatically purged. Optional passphrase protection adds a second factor that only the sender and recipient know. the secret has been independently audited, the source code is publicly available on GitHub, and self-hosted deployments allow security teams to keep everything inside their own infrastructure. By combining ephemeral storage with open-source transparency, it delivers a pragmatic privacy model for short-lived data exchange.

How It Works

The service operates through a three-stage pipeline: encrypt, distribute, and burn. First, the sender composes a one time secret in the browser; the client encrypts the data with a randomly generated key before transmitting it to the server. Second, it returns a unique URL that embeds the decryption key in the URL fragment, meaning the server itself never sees the plaintext. Third, when the recipient opens the link, the server retrieves the encrypted payload, the browser decrypts it locally, and the server immediately marks it as consumed. Subsequent requests for the same URL return a polite notification that the content has already been destroyed. This end-to-end design ensures that even operators cannot read what was shared.

Use Cases and Benefits

OnetimeSecret fits dozens of real-world workflows where permanent credential storage is undesirable. Developers share API keys with contractors during onboarding and revoke access the moment the link is opened. Support agents transmit temporary login credentials to customers without leaving passwords in ticket histories. Journalists exchange confidential tips through encrypted messages that vanish after a single read. Security teams provision recovery codes for executives during incident response, generating a unique URL for each one. The benefits are consistent across every scenario: the data lives only as long as it must, the recipient never needs an account, and the sender gains verifiable confirmation that the payload was retrieved. For organizations already using tools such as PrivNote, Yopass, or PrivateBin, it offers a mature, actively maintained alternative with enterprise-grade reliability and a thriving open-source community.