Send a password once.
Then it's gone.
Draft · no. 0000-0000
0 characters — encrypted locally before upload
Encrypted one-time link
The key lives after the #
The fragment contains the decryption key. Browsers do not send URL fragments in HTTP requests, so the server receives the secret ID but never this key.
What your teammate opens
One page, one button, no account. A shared link opens this confirmation gate.
Secretshare
Open a generated link to receive an encrypted secret.
A bot preview can't press this.
Read it now — this page won't load again
Download encrypted fileWiped
This secret was opened, expired, or does not exist.
How SecretShare works
- Encryption
-
The browser generates a 256-bit key and encrypts text or file bytes with authenticated AES-GCM before sending ciphertext.
- The key
-
The link places the key after
#. Browsers do not include URL fragments in HTTP requests, keeping the key separate from stored ciphertext. - Bot defense
-
A non-consuming landing request protects secrets from chat preview fetches. Only an explicit POST from the Open and destroy button consumes a secret.
- Files
-
Files up to 5 MB are read and encrypted locally. Their name, media type, and contents are all inside the encrypted payload.
- Deletion
-
The backend claims a stored record with an atomic rename before returning it, so concurrent opens cannot both retrieve the same ciphertext. Expired records cannot be consumed.
Stop pasting credentials into Slack.
Send one now