Create a single-use link for a short secret, with an expiry and an optional extra password.
OpenGuide
Send a password or key one time
A one-time secret keeps a password out of a chat history and out of a mailbox. The text is encrypted in your browser, the link is spent once the encrypted text is handed over, and the key that unlocks it stays in the part of the address your browser never sends to the server.
What this is for
A one-time secret carries short text: a password, an API key, a licence code, or a connection string. It is not a file transfer tool, and it is not a place to keep the secret for later.
Treat it as delivery, not storage. The site keeps the encrypted value only until the link is spent or expires, and it has no way to take back a copy the recipient already made.
How the encryption works
The browser generates a random key, encrypts the text with AES-256-GCM, and sends only the encrypted value. The server stores the ciphertext and the rules for the link: the expiry, the single view, and whether an extra password is required.
The key that unlocks the text travels after the # symbol in the link. Browsers do not send that part of an address to the server, so the site hosting the link never receives it.
Steps
- Open the one-time secret page.
- Paste the secret into the box.
- Choose an expiry: one hour, 24 hours, or seven days.
- Add an extra password if the secret is sensitive, and plan to send it through a different channel from the link.
- Create the link, copy it, and send it to the person who needs it.
How the single view is used
Opening the link shows a page, and that page holds no secret on its own. The view is spent by the API request that retrieves the encrypted text, which the page makes as it loads.
Anything that runs that page code, or calls the retrieval endpoint directly, can spend the view before your recipient sees it: a mail scanner that renders the page with scripts, a browser preview, or a chat app that expands the link in a real tab. A scanner that only requests the page address without running its code leaves the view untouched.
Because retrieval happens before the password is checked, a wrong password, a failed decryption, or a recipient who closes the tab early can also use up the view without showing anyone the secret.
Once the text is on screen, the recipient can copy it, photograph it, or forward it. The one-time link controls how the text is delivered, not what happens to it afterwards.
An expired link stops working at the end of its window even if nobody opened it.
Limits worth knowing
- While you are signed out, links are capped at 24 hours, so a seven-day choice becomes one day.
- Anyone holding the complete link can request the content if it has not been spent yet. Send it to one person through a channel you trust.
- The extra password protects the content, not the delivery. Send it separately, and never in the same message as the link.
- Keep your own copy of anything you send. Once the link is spent there is nothing left to recover.
Limits to keep in mind
- The single view is spent by the API request that retrieves the encrypted text. Loading the page address without running its code does not spend it; a preview, mail scanner, or chat app that runs the page or calls the endpoint does.
- Anything the recipient can see, they can copy or screenshot. Spending the link revokes it, but it cannot erase a copy that was already made.
- Signed-out links are capped at 24 hours. Sign in if you need a longer window.
- Anyone with the whole link, including the part after the #, can call the retrieval endpoint before the view is spent.
- A spent or expired link cannot be reopened. Create a new secret if the first attempt is lost.
Questions
Where does the decryption key live?
In the fragment after the # in the link. Browsers do not send the fragment to the server, so it stays out of the request and out of the access log.
Can I read the secret again after sending it?
No. The view is spent by the request that retrieves the encrypted text, which the page makes as it loads. Keep your own copy if you might need the value later.
What does the extra password add?
The browser derives a second key from it, so the link alone is not enough to decrypt the content. Send the password through a different channel.
How long can a link last?
Choose one hour, 24 hours, or seven days. While you are signed out, the seven-day option is shortened to 24 hours.
Can a link be used up before my recipient opens it?
It depends on what the checker does. Fetching the page address alone does not spend the view, but a scanner or preview that runs the page code, or calls the retrieval endpoint directly, spends it. Create a fresh link if the first one comes back already used.