OneTimeSecret is safe for a personal secret you would not mind one wrong person reading. For a business credential, it lacks three things an IT team ends up needing: encryption that happens before the text leaves your device, a way to pull a link back, and a record of who opened what. The one-view mechanism itself is sound and the project is open source. This review covers what that model protects, what it does not, and when to use something else.
Everything below about OneTimeSecret comes from its own pages, documentation and pricing on 19 October 2026. Features change; check them before you rely on them. We make LinkPilot, which competes with OneTimeSecret, so read the comparisons here with that in mind.
What OneTimeSecret is
OneTimeSecret is a web service, and an open-source project, for sharing a piece of text through a link that can be opened once. The hosted instance is onetimesecret.com; the code is on GitHub at github.com/onetimesecret/onetimesecret, with self-hosting instructions in its documentation.[1][2] You paste the text, optionally set an expiry and a passphrase, and send the link. The homepage puts the promise in one line: "Once the recipient opens the link, the data is permanently destroyed."[1]
The hosted free plan ("Basic") allows one custom domain, a [REST API](/glossary#rest-api "Glossary: rest api") and expiry windows "up to 14 days". Identity Plus (€35 per month) raises expiry to 30 days and adds unlimited domains; Team Plus (€125 per month) adds single sign-on, role-based access and an audit trail marked as beta.[3]
What the one-view model protects
The design does one thing well: it stops a secret from living on in the places it would otherwise live. A password pasted into email or Slack sits in two inboxes, two search indexes and every backup of both. A password behind a one-time link exists on the service until the first open, then it is gone, and the link that remains in the chat history leads nowhere. That protection is real, and it is the reason one-time links are the right default for a credential that has to travel.
OneTimeSecret adds two controls on top. An expiry, so a link nobody opens does not sit there indefinitely; and an optional passphrase, so a link that is forwarded to the wrong person does not open by itself.[1] Both are worth using every time.
Two further points in its favour. The code is public and the project describes it as community-audited, which is more than most hosted competitors offer.[2] And the homepage says each secret is stored and processed in the region you choose, which matters for teams with a data-residency rule.[1]
What it does not protect
The operator holds the key
OneTimeSecret's documentation says: "Your secrets are securely encrypted on our servers, ensuring data protection."[2] Read literally, that means the service receives your plaintext and encrypts it after the fact. The operator, or anyone with enough access to the operator's systems, could in principle read a secret while it is stored. For an open-source project run in the open for years that is a reasonable trust decision, and most people make it without thinking. It is still a decision. A tool that encrypts in the browser, with the key kept in the part of the link that browsers never send to a server, removes the operator from the list of people who could read the secret.
A passphrase narrows the exposure, but the public documentation does not say how the passphrase is stored or whether it feeds the encryption key, so we cannot say by how much. Use one anyway, and send it by a different channel than the link.
No way to take a link back
Once you have sent a OneTimeSecret link, the sender's view shows whether the secret has been received or burned.[1] The public documentation does not describe recalling an unread link from a dashboard. If you sent a credential to the wrong person, or the person leaves before opening it, your options are to rotate the credential or to wait for the expiry. For a personal note that is fine. For a client's admin password it is the gap that matters most.
No record of who opened it
The free hosted plan tells you a secret was opened. It does not keep a timeline of when, from where, or whether someone tried a wrong passphrase first; the audit trail is a Team Plus feature and is marked as beta on the pricing page.[3] No one-time link tool can tell you who opened a link, since a link carries no identity, but a timestamp and a coarse location are enough to decide whether to rotate. Can you see who opened a one-time link? compares what seven tools record.
Everything a one-time link cannot do, on any tool
These are not OneTimeSecret problems; they are one-time link problems, and they apply to LinkPilot as much as to anyone.
- A link forwarded before it is opened is a credential in the wrong hands. Short expiry and a passphrase on a second channel are the only defences.
- A link preview can consume a one-time link if the service reveals the secret on a plain fetch. OneTimeSecret shows a confirmation page before the reveal, and so does LinkPilot; check the behaviour of any other tool before pasting a link into Slack. Link scanners and one-time secrets explains the mechanism.
- Lookalike domains. The category has attracted phishing clones (the documented cases involve Privnote, not OneTimeSecret); type the domain yourself and never reach a secrets tool through an ad.
When OneTimeSecret is the right choice
- You want a single-purpose tool you can read the source of and run on your own server. LinkPilot cannot be self-hosted, so this is not a close call.
- You send an occasional personal secret and do not need a record or a way to recall it.
- Data residency is a hard requirement and the regions OneTimeSecret offers match yours.
When to use something else
- You need to revoke a link after sending it.
- You need a record of each open for an audit, a client security questionnaire or your own incident response.
- You want the secret encrypted before it leaves your browser, so that no operator holds the key.
- You share secrets as a team and want roles, a workspace and a Slack app rather than a personal account.
For that list, LinkPilot's free one-time secret link generator encrypts in the browser without an account; revocation, the per-secret timeline and passphrases are on Pro, and the head-to-head is in LinkPilot vs OneTimeSecret. The wider field, including Password Pusher, PrivateBin and Yopass for self-hosters, is in best OneTimeSecret alternatives, and the password-sharing method itself is covered in secure password sharing for teams.
How to use OneTimeSecret safely
- Type onetimesecret.com yourself; do not follow a search ad.
- Set the shortest expiry the recipient can meet.
- Add a passphrase and send it through a different channel than the link (link by email, passphrase by chat or phone).
- Check the sender view after a day. If the secret has not been received, rotate the credential rather than resend the link.
- Never put the secret and its context (which system, which account) in the same message.
References
[1] Onetime Secret. Homepage. https://onetimesecret.com/. Checked 19 October 2026.
[2] Onetime Secret. Documentation. https://docs.onetimesecret.com/. Checked 19 October 2026.
[3] Onetime Secret. Pricing. https://onetimesecret.com/en/pricing. Checked 19 October 2026.
[4] OneTimeSecret source repository. https://github.com/onetimesecret/onetimesecret.