A password pasted into Slack, WhatsApp or email sits in that history indefinitely, gets backed up, and is visible to anyone who later gains access to the account.
Your secret
Encrypted in your browser
Never send the passphrase down the same channel as the link.
0 / 32768
Share this separately from the link
How it works
1
Encrypt locally
Your browser generates a random 256-bit key and encrypts the text before anything is sent.
2
Store ciphertext
Only the encrypted blob reaches our server. The key stays in the link fragment, which is never transmitted.
3
Share the link
Send it however you like. Anyone with the link and the passphrase, if set, can read it once.
4
It self-destructs
On retrieval the record is deleted. A second attempt to open the link finds nothing.
Why not just send it over chat?
The secret is deleted from the server the moment it is retrieved. If the recipient says the link is already used, you know someone else opened it — a built-in tamper signal.
Encryption happens in your browser and the key is placed in the part of the link after the # symbol, which browsers never send to the server. We only ever store ciphertext.
Frequently asked questions
How is the secret encrypted?
Your browser generates a random AES-256-GCM key, encrypts the text locally, and sends only the ciphertext to the server. The key is placed in the URL fragment — the part after the # — which browsers never transmit in a request. Without that fragment the stored data is unreadable.
What happens after someone opens the link?
The ciphertext is deleted from the server immediately on retrieval. Opening the same link again shows a "already viewed or expired" message. This is deliberate: it means an already-used link is evidence that someone else saw the secret.
How long does an unread secret last?
You choose: one hour, one day, or seven days. When the expiry passes, the record is purged whether or not it was ever read.
What does the optional passphrase add?
It requires the recipient to type a shared word before the secret decrypts, so intercepting the link alone is not enough. Send the passphrase through a different channel than the link — that is the entire point.
Is there a size limit?
Yes, 32 KB of text, which is ample for credentials, API keys, recovery codes or a short note. This is a secret-sharing tool, not file transfer.