OnetimeSecret — Send a Self-Destructing One Time Secret in Seconds

What is OnetimeSecret?

the secret is an open-source privacy service that lets a sender transmit a confidential message — a password, an API key, a recovery phrase, a private URL — through a single-view encrypted link. It was built around a simple cryptographic idea: the value itself is encrypted on the client, and only the resulting cipher text is stored on the server. When the recipient opens the unique URL, the decryption key inside the fragment unlocks the content in the browser, the payload is displayed once, and the server immediately deletes the record. Nothing remains to be backed up, indexed, or subpoenaed later. This makes it fundamentally different from email, chat, or cloud notes, where every message is duplicated, replicated, and searchable long after it has served its purpose.

The whole point of OnetimeSecret is that a message exists exactly once — read, then gone, leaving no trace behind.

Key Features and Advantages

The feature set around OnetimeSecret is intentionally narrow and well engineered. Each one time secret can be protected by an additional passphrase, given a custom lifetime, restricted by email address, or flagged with a notification on read. A REST API lets developers embed the same onetime secret primitive inside CI pipelines, ticketing systems, and onboarding flows. Premium tiers unlock branded domains, longer expiry windows, and team dashboards. For most users the free tier is more than sufficient, but for organizations that need consistent branding across internal share secret workflows, the upgrade is inexpensive and well documented.

Security and Privacy

Security is the central reason anyone chooses this secret service in the first place. Encryption happens client-side using a strong symmetric cipher, the URL carries the decryption material in its fragment so the server never sees it, and the database record is wiped the moment a recipient views the message or the TTL expires. There is no account required to receive a secret link, no tracking pixels, and no third-party analytics bundled into the recipient experience. The codebase is open source, which means independent researchers and curious engineers can audit the exact mechanism that protects every transmission, every password, and every payload the service touches.

How It Works

The workflow inside the secret follows a clean four-step lifecycle. First, the sender composes the one time secret on the homepage; the JavaScript in the browser immediately encrypts the text before any network call. Second, the server stores only the encrypted blob and returns a unique URL. Third, the sender transmits that URL to the recipient through email, chat, or any other channel. Fourth, when the recipient opens the page, the browser decrypts the payload locally, displays it once, and instructs the server to delete the record. The entire share secret transaction is finished in seconds, leaving behind nothing that could be reconstructed later.

Use Cases and Benefits

The practical applications of this secret service span nearly every modern workflow where sensitive data has to cross an insecure channel. DevOps teams use it to deliver root passwords into freshly provisioned servers. Journalists use it to pass source material to editors. Support agents use it to send recovery codes to customers without leaving copies in inboxes. Recruiters use it to transmit offer-letter URLs to candidates. The benefit in each case is the same: the message is delivered exactly once, the link expires on a known schedule, and the sender receives confidence that the transmitted password or token will not leak through a forgotten inbox months later.