Create Encrypted Secret
Please enter secret content before creating.
Result
Enter your secret and click Create Encrypted Secret to generate a secure link.
No recently used tools
Loading categories...
crypto.getRandomValues.Don't put the password in the email itself. Use a one-time encrypted link: paste the password here, get a short URL and a separate random password, then email the URL and send the password through a different channel (Slack, SMS, phone). The link self-destructs after the first view.
A one-time secret is an encrypted message stored at a short URL that can be opened only once. After the first read the server deletes the record and any later visit returns 410 Gone. It's the standard way to share passwords, API keys, and credentials without leaving them in chat history or inboxes.
When the recipient clicks Reveal, the server atomically increments a view counter and — if the configured cap (default 1) is reached — deletes the database record before serving the ciphertext. Any subsequent visit returns a generic 410 Gone, so the secret cannot be replayed.
Generate a one-time encrypted link, set view cap to 1 (burn after read), email the URL, and send the random password through Slack or SMS. Rotate the key after they confirm receipt. Never paste API keys into a chat message, ticket, or git commit — those persist forever.
You choose: 5 minutes, 1 hour, 24 hours (default), or 7 days. Whichever happens first — expiry timeout or view cap — destroys the secret. Recipients see a generic 'no longer available' message after that; expired, burned, and invalid all return the same 410 response to avoid a shortcode-guessing oracle.
Yes. Same core model as OneTimeSecret and PrivateBin — encrypted one-time links — but free, with no signup, no email required, no rate limits, and AES-256-GCM via the browser's native Web Crypto API. The server only ever sees ciphertext.
Yes. Encryption runs in your browser with AES-256-GCM before any network call. A 16-character random password is hashed with SHA-256 to derive the AES key, a fresh 96-bit IV is generated per encryption, and only the ciphertext + IV are uploaded. The server never sees plaintext or password.
No. No account, no email required (optional notification only), no tracking on the secret view page, and no limit on the number of secrets you can create. Just paste, share, done.