Everything you need to know about sharing secrets with OneTimePass. Can't find your answer? Contact us.
No. Your secret is encrypted in your own browser with AES-256-GCM before it is sent to us. The key needed to decrypt it is the part of the link after the # sign, and browsers never send that part of a link to a server. We only ever receive and store encrypted data that we cannot read. (If JavaScript is turned off in your browser, the secret is encrypted on our server instead; the page tells you when that happens.)
Opening the link only shows a Reveal button; the secret itself is not sent yet. When the recipient clicks it, the secret is deleted from our server and then shown in their browser. After that, the link shows "This secret has expired or has already been viewed".
No. When you paste a link into Slack, Teams, WhatsApp or similar apps, they fetch the page to build a preview. They only get the page with the Reveal button, so the secret stays unopened for your recipient.
They would see the secret, and your recipient would then get the "already viewed" message, so you would know the link was intercepted. For extra protection, add a passphrase and send it to the recipient through a different channel, for example by phone.
If you set a passphrase, the recipient has to enter it before the secret is revealed. After 5 incorrect passphrases the secret is permanently destroyed, so it cannot be guessed.
Some apps shorten long links. Without the part after the #, the secret cannot be decrypted, so the page warns the recipient and does not delete the secret. Ask the sender for the complete link.
A secret that nobody opens expires at the time you chose when creating it: 1 hour, 1 day or 7 days (the longest). From that moment it can no longer be opened, and our regular cleanup then permanently deletes it from the database.
Not yet. If you are worried about a link, choose a short expiry such as 1 hour when you create the secret.
No. A secret is deleted from our database the moment it is revealed. We do not keep copies or logs of secret contents.
No. There is no sign-up and no login. Type your secret, create the link and share it.
Yes, all tools on this site are free to use.
Any text: passwords, access codes, API keys, private links or short notes. File attachments are not supported.
After you create a secret, the page shows a QR code for the link. The recipient can scan it with their phone camera. Treat the QR code like the link itself: anyone who scans it can open the secret.
The password generator creates passwords with a cryptographically secure random number generator and never stores them. Use Share securely to send a generated password as a one-time secret link.
The site works without cookies. We only use Google Analytics cookies if you agree to them in the cookie banner, and analytics never runs on pages that show a secret. See the privacy policy for details.
It takes a few seconds and no sign-up. Create a one-time secret link.