FreeNo accountEnd-to-end encrypted
Share a secret. Read once, then gone.
Passwords, API keys, private notes and files travel as a link that destroys itself after reading. Everything is encrypted in your browser: we never see what you share, and we never see the key.
- Encrypted in your browser with AES-256-GCM
- The key stays in the link and never reaches us
- Burned after reading: nothing left on our servers
- No account, no ads, no cookies
Your secret is sealed.
Keep it for yourself: it shows when the secret is read, and lets you burn it now. It cannot open the secret.
Three steps, zero trust required.
You don't have to trust us with your secret, because we never have it. Only scrambled bytes reach our servers, and only the person holding the link can turn them back into your secret.
-
01 · Write
Paste your secret
A password, a recovery code, an API key, a contract. Attach files if you need to. Choose how long it lives and how many times it can be opened.
-
02 · Seal
Your browser encrypts it
A fresh 256-bit key is generated on your device. The secret is encrypted with AES-256-GCM before anything is sent. We store ciphertext, never the key.
-
03 · Send
The link is the key
The key rides after the
#in the link, the part browsers never send to a server. Once read, the secret is wiped from our database.
Request a secretPost-quantum
Need a password from a client?
Send them a request link instead of asking them to email it. They type the secret, their browser encrypts it to your key, and only you can open it. The exchange uses X-Wing, a hybrid of ML-KEM-768 and X25519, built to stay safe even against future quantum computers.
Request a secret- You create a request. Your browser makes a key pair. The private half stays in your private inbox link.
- They answer. Their browser encrypts the secret to your public key. We only relay ciphertext.
- You open it, once. Your inbox link decrypts it on your device, then the response is erased.
Built for people who trust no one. Including us.
Every claim below is checkable: the encryption runs in your browser, in code you can read. Read the full specification →
| Encryption | AES-256-GCM, in your browser (Web Crypto API). |
|---|---|
| Key | 256 random bits, carried in the link after the #, never sent to our servers. |
| Access proof | We hand the ciphertext only to a browser that proves it holds the key. Guessing a link gets nothing, not even the encrypted bytes. |
| Passphrase | Optional second factor, stretched with Argon2id (64 MiB, 3 passes, RFC 9106). Ten wrong attempts destroy the secret. |
| Requests | X-Wing hybrid key exchange: ML-KEM-768 (FIPS 203) + X25519. Post-quantum. |
| Size | Padded to fixed tiers, so the ciphertext doesn't reveal how long your password is. |
| Link previews | Slack, Teams and email scanners can open the link: nothing is used up until a person presses and holds Reveal for a second. Scanners click; they don't hold. |
| Our servers | No access logs, no IP addresses stored, no third-party scripts, a strict Content Security Policy. Hosted in France. |
How it compares.
What you get for free, without creating an account, on the tools people use most to send a password.
| Free, no account | secretshare | onetimesecret | password.link | Privnote | Password Pusher |
|---|---|---|---|---|---|
| Encrypted in your browser: the server can't read it | ✓ yes | ✗ no server-side | ✓ yes | ✓ yes | ✗ no server-side |
| Choose expiry and number of views | ✓ yes | expiry only | ✗ no | expiry only | ✓ yes |
| Passphrase | ✓ yes Argon2id | ✓ yes | ✗ no | ✓ yes | ✓ yes |
| Attach files | ✓ yes 10 MB | ✗ no | ✗ no | ✗ no | ✗ no |
| Request a secret from someone | ✓ yes | ✗ no account | ✗ no account | ✗ no | ? not documented |
| Post-quantum key exchange for requests | ✓ yes X-Wing | ✗ no | ✗ no | ✗ no | ✗ no |
| No ads | ✓ yes | ✓ yes | ✓ yes | ✗ no | ✓ yes |
Checked in October 2026 on each service's own website, documentation and published source code, for anonymous use without an account. “?” means the service does not document it. Paid plans and accounts unlock more on some of them. Spotted a mistake? Tell us and we will fix it.
Questions, answered.
Still unsure? The security page describes every step of the encryption.
Can you read my secrets?
No. Your browser encrypts the secret before sending it, and the key stays in the part of the link after the #, which browsers never send to a server. We only ever hold ciphertext we cannot open.
What if Slack, Teams or Outlook opens the link first?
Nothing is lost. Opening the page reveals nothing and uses up no view. To reveal the secret, a person has to press and hold the button for a second: link previews never run the page, and the email security scanners that do click buttons don't hold them. For complete certainty, add a passphrase: no scanner can type it.
What happens after the secret is read?
On its last allowed view, the ciphertext is deleted from our database in the same transaction that hands it over. What remains until the expiry date is a receipt: when it was read, never what it said.
How do I know the secret was received?
When you create a secret, you get a private tracking link. It shows whether and when the secret was opened, and lets you burn it early. No account needed.
Why add a passphrase?
If the link leaks, say in a forwarded email, the passphrase still protects the secret. Send it through a different channel. Ten wrong guesses destroy the secret, so it can't be brute-forced.
What does "post-quantum" mean here?
Secret links use AES-256 with a key that never travels over the network, which is already considered safe against quantum computers. Requests are different: they rely on public-key cryptography, which future quantum computers could break. That's why requests use X-Wing, which combines the new ML-KEM-768 standard with classic X25519.
Is it really free?
Yes. No account, no ads, no trial. Sharing and requesting secrets is free.
Who runs secretshare?
Kiora, a software company based in Puteaux, France. The servers are ours and they are in France. See the legal notice.