Share a one-time secret — encrypted, self-destructing
Send passwords, API keys and client secrets as links that work exactly once. Encrypted in your browser before anything is uploaded — the server never sees the plaintext, and nothing stays behind in inboxes.
How it works
Why one-time links?
Anything you paste into an email or chat is archived forever — searchable, forwardable, and one mailbox breach away from being public. A one-time link removes the secret from that permanent record: after the first view there is nothing left to steal.
One-time semantics also make interception visible. If an attacker opens the link before the intended recipient, the recipient finds a dead link, you see the early retrieval — and you know to rotate the secret immediately. With a plain email, you would never find out.
End-to-end encrypted in your browser
1xSecret encrypts with AES-256-GCM before upload. The key is derived from a random 256-bit master key that only exists in the link fragment (the part after “#”) — browsers never send fragments to servers, so the operator stores ciphertext it cannot decrypt.
An optional retrieval password is stretched with Argon2id and folded into the key derivation on your device. It is required for decryption itself, not just checked by the server — and it never leaves your browser.
Retrieval uses a cryptographic challenge: your browser proves possession of the key material with an Ed25519 signature before the server releases the ciphertext and destroys it. Link scanners and preview bots can never burn a secret, and a wrong password never consumes it.
What can you share?
Open source & self-hosted in minutes
1xSecret is free software (AGPL-3.0). Run it with Docker Compose or the Helm chart on your own domain, bring your own PostgreSQL, and mount your own legal pages. German and English are built in.
The safeguarded mode restricts retrieval to your company networks: partners can send secrets to you and receive secrets from you, but third parties cannot use your instance to exchange secrets among themselves.
Frequently asked questions
What exactly happens when a secret is viewed?
The moment the recipient clicks “Reveal once”, the server verifies the cryptographic challenge, hands over the ciphertext and deletes it in the same atomic step. Only the retrieval timestamp is kept (30 days by default) so the creator can see that — and when — the secret was picked up.
What if the link is intercepted?
If someone opens the link before your recipient, the recipient finds a dead link and tells you — interception becomes visible, and you rotate the secret. If you additionally set a retrieval password (shared over a different channel), the thief cannot open the secret at all: ten wrong attempts destroy it.
What does the server actually see?
Ciphertext, a random salt, a public key for the challenge signature, and timestamps. Never the plaintext, never the key (it lives in the link fragment, which browsers don't transmit), never the password. Even a full database dump does not allow decryption.
Why should I set a retrieval password?
The link alone is a single factor: whoever has it, has the secret. A password shared over a second channel (phone, chat, in person) turns it into two factors. In 1xSecret the password is part of the encryption key itself — it is never sent to or checked by the server.
Can a mail scanner or link preview “use up” my secret?
No. Opening the page never consumes the secret. Retrieval requires an explicit click plus a signed cryptographic challenge that only a browser holding the key material (and password) can produce.
How long is a secret stored?
You choose: 10 minutes to 1 month. Whatever is not retrieved in time is destroyed. After retrieval (or expiry), only an anonymous read-receipt row remains for 30 days, then it is deleted too.
Can I see whether my secret was retrieved?
Yes. Your browser keeps a private, local list of the secrets you created (“My secrets”). It shows whether and when each one was retrieved — the label you give an entry never leaves your device.
What is the safeguarded mode?
A self-hosting option for companies. Secrets created from your allowed networks (CIDR ranges) are retrievable by anyone with the link; secrets created by outsiders can only be retrieved from inside those networks. Your instance stays useful for exchanging secrets with partners without becoming a free public service.
Is 1xSecret free?
Yes — free and open source under the AGPL-3.0 license. You can use the hosted instance or run your own with Docker or Helm within minutes.
How is this better than sending a password by email?
Email is stored forever, in at least two mailboxes, often unencrypted, and is searchable and forwardable. A one-time link keeps the secret out of the archive, makes interception detectable, expires automatically — and with a retrieval password even a compromised mailbox is not enough.