Send a Secret
Processed on our servers. Nothing is stored after your request completes.
Save this tool
Keep Send a Secret handy
Use your browser's Share menu, then “Add to Home Screen”.
Share a password by link that self-destructs after one read
- Type or paste the secret — a password, a recovery code, an API key.
- Choose how long the link should last if nobody opens it.
- Add a password if the link itself might be seen by the wrong person, and send that separately.
- Copy the link and send it. Keep it safe: once you close this page, nobody can recover it.
Up to 10 KB — this is for a password, not a document.
Your link is ready
Copy it now. Once you leave this page nobody can recover this link — not you, and not us, because we never had the key.
The password is not in the link. Send it another way, and remember it: without it the secret cannot be opened at all.
The secret is encrypted in your browser. The key goes in the part of the link after the # symbol, which browsers never send to a server — so what we store is something we cannot read. Anyone with the link can read it once.
About this tool
Passwords get sent in chat messages and emails, and then they sit there — in the history, in the archive, in whatever backs that service up, for as long as the account exists. This gives you a link instead. Type the secret, get a link, send it; the first person to open it sees it once and it is gone, including for you. The encryption happens in your browser before anything leaves it. The key travels in the part of the link after the hash symbol, which browsers never send to a server — so what we store is ciphertext we have no way to open. That is a real property of how the web works rather than a promise we are making. It is not magic, and the page says so plainly: anyone who sees the link can read the secret, so if the link might be seen, add a password and send that through a different channel. The link also has an end date whether or not anybody opens it. Free, with no account, because a tool like this is only useful if it is there when you need it.
Frequently asked questions
Can you read my secret?
No, and not as a matter of policy. The key is in the link after the # symbol, and browsers never send that part to a server — not in the request, not in the referrer, not to a proxy. What reaches us is ciphertext and an initialisation vector. A full copy of our database would be useless.
So it is end-to-end encrypted?
Not in the strongest sense, and it would be dishonest to claim it. We serve the JavaScript that does the encrypting, so you are trusting the code we send you at the moment you use it. The accurate statement is that we do not receive your key — not that we could not have. Anyone who needs a guarantee stronger than that needs software they can build and verify themselves.
What if someone else opens the link first?
They get the secret and you get nothing. That is what one-time means, and it is also the warning system: if the recipient says the link was already used, somebody else saw it. Treat the secret as compromised and change it.
Will link previews in Slack or Teams use it up?
They should not. The secret is only fetched when somebody presses Reveal, and preview bots fetch pages rather than pressing buttons. That is why there is a button at all instead of the secret simply appearing.
What does the password add?
It changes what the link is worth. Without one, anybody holding the link can read the secret. With one, the key is derived from your password rather than carried in the link, so the link alone opens nothing. Send the link one way and the password another and neither channel is enough on its own.
Why is there a size limit?
It is for a password, a recovery code, an API key — not a document. Ten kilobytes is far more than any credential needs, and keeping it small is also what stops the tool being useful as an anonymous drop for things nobody should be passing around.
Help improve this tool
Found a bug, want a change, or need a tool we don't have?
You have an unsent draft.
Thanks — that's with us. You'll find the reply in your inbox.Go to my messages