End-to-end encrypted temporary secrets - share passwords, keys, and sensitive data safely (24-hour expiry)
Enter your secret and click
"Encrypt & Share Secret"
to generate a secure link
Your secret is encrypted with AES-256-GCM in your browser before upload. The server receives only encrypted data - it never sees your plaintext or password. True zero-knowledge design.
Client-Side Encryption: AES-256-GCM in browser
Separate Channels: URL + password sent separately
Multiple Access: View anytime within 24 hours
Auto-Expires: Deleted after 24 hours
Send URL via email, password via Slack/SMS. Attacker needs to compromise both channels.
Send both URL and password in same email. If email is intercepted, secret is exposed.
Share secret unencrypted or via unsecured channel. Always encrypt sensitive data.
Creator of 8gwifi.org's suite of 100+ free security and cryptography tools used by over 500,000 professionals monthly.
Why Trust This Tool?
This secure secret sharing tool implements industry-standard AES-256-GCM encryption using the browser's native Web Crypto API. The code follows OWASP secure coding guidelines, uses cryptographically secure random number generation (crypto.getRandomValues), and implements a true zero-knowledge architecture where the server never has access to your plaintext or encryption password. All cryptographic operations are performed client-side, ensuring your secrets remain private.
Your text is encrypted locally in your browser using AES-256-GCM encryption. You receive a unique view URL and a randomly-generated password. Share them via different channels (e.g., URL via email, password via Slack). The secret expires after it's viewed once or after a limited time, whichever comes first.
Yes. Encryption and decryption happen client‑side in your browser using the Web Crypto API and AES‑256-GCM algorithm. The server receives only encrypted ciphertext - it never has access to your plaintext or your encryption password. This is a true zero-knowledge architecture.
We use AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode). This is military-grade authenticated encryption that provides both confidentiality and integrity. The password you receive is SHA-256 hashed to derive the encryption key, and each encryption uses a cryptographically random 96-bit initialization vector (IV).
Suitable: Passwords, API keys, SSH private keys, database credentials, credit card info, license keys, temporary access tokens, VPN credentials, or any one-time sensitive text.
Not Suitable: Master passwords for password managers, 2FA recovery codes, long-term credentials that won't be rotated, or secrets you're not authorized to transmit.
Secrets are time-limited and designed for one-time access only. After the first viewing, the secret is immediately deleted from the server. If the secret is never accessed, it automatically expires after a limited time period for security. This ensures secrets don't remain accessible indefinitely.
Sharing via separate channels (URL via email, password via Slack/SMS) provides defense in depth. An attacker would need to compromise both communication channels to access your secret. If you send both in the same email, a single email interception exposes the secret. This is security best practice known as "two-factor communication".
No. Your secret is encrypted in your browser before any network transmission. The server only stores encrypted ciphertext. Neither server administrators nor anyone with database access can decrypt your secret without the password, which never leaves your browser and is never transmitted to the server. This is the core principle of zero-knowledge architecture.
This tool provides strong encryption and zero-knowledge architecture, which are important security controls. However, compliance depends on your specific use case, organization policies, and regulatory requirements. For highly regulated data (PHI, PII), consult your compliance team and consider dedicated secret management systems designed for regulatory compliance (e.g., HashiCorp Vault, AWS Secrets Manager with audit logging).
This tool requires the Web Crypto API, which is supported by all modern browsers: Chrome 37+, Firefox 34+, Safari 11+, Edge 12+, and Opera 24+. Internet Explorer is not supported. The tool will not work if JavaScript is disabled.
No. Once a secret is viewed, it is immediately and permanently deleted from the server. There is no backup or recovery mechanism - this is by design for security. If you need the secret again, you must create a new encrypted share.
Yes, there are practical size limits for text-based secrets (typically several KB). This tool is designed for short-form sensitive text like passwords and API keys, not for large files or documents. For encrypting files, use our PGP File Encryption tool.
No. This tool requires no registration, no login, no account creation. It's completely anonymous. We don't track who creates secrets or who views them (beyond basic server logs for operational purposes). This ensures maximum privacy.
Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.