--- title: "Is OneTimeSecret Safe? A 2026 Security Review" url: https://uselinkpilot.com/blog/is-onetimesecret-safe description: "OneTimeSecret is open source and widely used. What its model protects, what it does not (revocation, audit trail, team controls), and when to use something else." lang: en --- Security (https://uselinkpilot.com/blog/category/security) # Is OneTimeSecret safe? OneTimeSecret is open source and widely used. What its model protects, what it does not (revocation, audit trail, team controls), and when to use something else. LinkPilot Team October 19, 2026 · About LinkPilot (https://uselinkpilot.com/about) **OneTimeSecret is safe for a personal secret you would not mind one wrong person reading. For a business credential, it lacks three things an IT team ends up needing: encryption that happens before the text leaves your device, a way to pull a link back, and a record (https://uselinkpilot.com/glossary#a-record) of who opened what.** The one-view mechanism itself is sound and the project is open source. This review covers what that model protects, what it does not, and when to use something else. Everything below about OneTimeSecret comes from its own pages, documentation and pricing on 19 October 2026. Features change; check them before you rely on them. We make LinkPilot, which competes with OneTimeSecret, so read the comparisons here with that in mind. ## What OneTimeSecret is OneTimeSecret is a web service, and an open-source project, for sharing a piece of text through a link that can be opened once. The hosted instance is onetimesecret.com; the code is on GitHub at github.com/onetimesecret/onetimesecret, with self-hosting instructions in its documentation.[1][2] You paste the text, optionally set an expiry and a passphrase, and send the link. The homepage puts the promise in one line: "Once the recipient opens the link, the data is permanently destroyed."[1] The hosted free plan ("Basic") allows one custom domain (https://uselinkpilot.com/glossary#custom-domain), a [REST API (https://uselinkpilot.com/glossary#api)](/glossary#rest-api "Glossary: rest api") and expiry windows "up to 14 days". Identity Plus (€35 per month) raises expiry to 30 days and adds unlimited domains; Team Plus (€125 per month) adds single sign-on (https://uselinkpilot.com/glossary#single-sign-on), role-based access and an audit trail (https://uselinkpilot.com/glossary#link-history) marked as beta.[3] ## What the one-view model protects The design does one thing well: it stops a secret from living on in the places it would otherwise live. A password pasted into email or Slack sits in two inboxes, two search indexes and every backup of both. A password behind a one-time link (https://uselinkpilot.com/glossary#one-time-link) exists on the service until the first open, then it is gone, and the link that remains in the chat history leads nowhere. That protection is real, and it is the reason one-time links are the right default for a credential that has to travel. OneTimeSecret adds two controls on top. An expiry, so a link nobody opens does not sit there indefinitely; and an optional passphrase, so a link that is forwarded to the wrong person does not open by itself.[1] Both are worth using every time. Two further points in its favour. The code is public and the project describes it as community-audited, which is more than most hosted competitors offer.[2] And the homepage says each secret is stored and processed in the region you choose, which matters for teams with a data-residency rule.[1] ## What it does not protect ### The operator holds the key OneTimeSecret's documentation says: "Your secrets are securely encrypted on our servers, ensuring data protection."[2] Read literally, that means the service receives your plaintext and encrypts it after the fact. The operator, or anyone with enough access to the operator's systems, could in principle read a secret while it is stored. For an open-source project run in the open for years that is a reasonable trust decision, and most people make it without thinking. It is still a decision. A tool that encrypts in the browser, with the key kept in the part of the link that browsers never send to a server, removes the operator from the list of people who could read the secret. A passphrase narrows the exposure, but the public documentation does not say how the passphrase is stored or whether it feeds the encryption key, so we cannot say by how much. Use one anyway, and send it by a different channel than the link. ### No way to take a link back Once you have sent a OneTimeSecret link, the sender's view shows whether the secret has been received or burned.[1] The public documentation does not describe recalling an unread link from a dashboard. If you sent a credential to the wrong person, or the person leaves before opening it, your options are to rotate the credential or to wait for the expiry. For a personal note that is fine. For a client's admin password it is the gap that matters most. ### No record of who opened it The free hosted plan tells you a secret was opened. It does not keep a timeline of when, from where, or whether someone tried a wrong passphrase first; the audit trail is a Team Plus feature and is marked as beta on the pricing page.[3] No one-time link tool can tell you _who_ opened a link, since a link carries no identity, but a timestamp and a coarse location are enough to decide whether to rotate. Can you see who opened a one-time link? (https://uselinkpilot.com/blog/can-you-see-who-opened-a-one-time-link) compares what seven tools record. ### Everything a one-time link cannot do, on any tool These are not OneTimeSecret problems; they are one-time link problems, and they apply to LinkPilot as much as to anyone. - A link forwarded before it is opened is a credential in the wrong hands. Short expiry and a passphrase on a second channel are the only defences. - A link preview can consume a one-time link if the service reveals the secret on a plain fetch. OneTimeSecret shows a confirmation page before the reveal, and so does LinkPilot; check the behaviour of any other tool before pasting a link into Slack. Link scanners and one-time secrets (https://uselinkpilot.com/blog/link-scanners-and-one-time-secrets) explains the mechanism. - Lookalike domains. The category has attracted phishing clones (the documented cases involve Privnote, not OneTimeSecret); type the domain yourself and never reach a secrets tool through an ad. ## When OneTimeSecret is the right choice - You want a single-purpose tool you can read the source of and run on your own server. LinkPilot cannot be self-hosted, so this is not a close call. - You send an occasional personal secret and do not need a record or a way to recall it. - Data residency is a hard requirement and the regions OneTimeSecret offers match yours. ## When to use something else - You need to revoke a link after sending it. - You need a record of each open for an audit, a client security questionnaire or your own incident response. - You want the secret encrypted before it leaves your browser, so that no operator holds the key. - You share secrets as a team and want roles, a workspace and a Slack app rather than a personal account. For that list, LinkPilot's free one-time secret link generator (https://uselinkpilot.com/tools/free-secret-link-generator) encrypts in the browser without an account; revocation, the per-secret timeline and passphrases are on Pro, and the head-to-head is in LinkPilot vs OneTimeSecret (https://uselinkpilot.com/compare/linkpilot-vs-onetimesecret). The wider field, including Password Pusher, PrivateBin and Yopass for self-hosters, is in best OneTimeSecret alternatives (https://uselinkpilot.com/blog/best-onetimesecret-alternatives), and the password-sharing method itself is covered in secure password sharing for teams (https://uselinkpilot.com/secure-password-sharing). ## How to use OneTimeSecret safely 1. Type onetimesecret.com yourself; do not follow a search ad. 2. Set the shortest expiry the recipient can meet. 3. Add a passphrase and send it through a different channel than the link (link by email, passphrase by chat or phone). 4. Check the sender view after a day. If the secret has not been received, rotate the credential rather than resend the link. 5. Never put the secret and its context (which system, which account) in the same message. ## References **[1]** Onetime Secret. _Homepage_. https://onetimesecret.com/. Checked 19 October 2026. **[2]** Onetime Secret. _Documentation_. https://docs.onetimesecret.com/. Checked 19 October 2026. **[3]** Onetime Secret. _Pricing_. https://onetimesecret.com/en/pricing. Checked 19 October 2026. **[4]** OneTimeSecret source repository. https://github.com/onetimesecret/onetimesecret. ## Tools mentioned in this article One-Time Secret Link Generator Share a password or note through a link that opens once. https://uselinkpilot.com/tools/free-secret-link-generator Self-Destructing Message Send a note that disappears after one read. https://uselinkpilot.com/tools/burn-after-read-secret ## Frequently asked questions ### Is OneTimeSecret safe to use? ### Is onetimesecret.com legit? ### Can OneTimeSecret read my secret? ### Can I revoke or recall a OneTimeSecret link? ### What is a safer alternative to OneTimeSecret for a team? ## LinkPilot sends a secret link that is gone after it is opened. Encrypted in your browser, revealed once, then destroyed. No account needed. Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator) ## Read next Security ### Apps With Self-Destructing Messages: Signal, WhatsApp, Telegram and When a Link Is Better How disappearing messages work in Signal, WhatsApp and Telegram, what each timer actually deletes, what none of them stop (screenshots, forwards), and when a one-time link fits better. https://uselinkpilot.com/blog/self-destructing-message-apps Security ### How to Send a Self-Destructing Email (Gmail, Outlook and Any Inbox) Gmail's confidential mode and Outlook's expiry setting, what each really deletes, and the method that works for any inbox: put the sensitive part behind a one-time link. https://uselinkpilot.com/blog/how-to-send-a-self-destructing-email Security ### Can You See Who Opened a One-Time Secret Link? What Each Tool Records No tool can name the person. Here is what each one-time secret service records when a link is opened: OneTimeSecret, Password Pusher, Bitwarden Send, Yopass, PrivateBin, password.link and LinkPilot. https://uselinkpilot.com/blog/can-you-see-who-opened-a-one-time-link ## Structured data ```json [ { "@context": "https://schema.org", "@type": "SoftwareApplication", "@id": "https://uselinkpilot.com/#software", "name": "LinkPilot", "applicationCategory": "BusinessApplication", "operatingSystem": "Web", "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "url": "https://uselinkpilot.com", "offers": [ { "@type": "Offer", "name": "Free", "price": "0", "priceCurrency": "USD", "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Pro", "price": "29", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "29", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency", "price": "299", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "299", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency Plus", "price": "799", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "799", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Enterprise", "priceSpecification": { "@type": "PriceSpecification", "priceCurrency": "USD" }, "url": "https://uselinkpilot.com/pricing" } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://uselinkpilot.com/#organization", "name": "LinkPilot", "alternateName": "LinkPilot by TetraCore", "url": "https://uselinkpilot.com", "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "support@uselinkpilot.com", "url": "https://uselinkpilot.com/support" }, "parentOrganization": { "@type": "Organization", "@id": "https://tetracorehq.com/#organization", "name": "TetraCore", "url": "https://tetracorehq.com/" }, "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 }, "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "sameAs": [ "https://x.com/uselinkpilot", "https://www.linkedin.com/company/uselinkpilot", "https://facebook.com/uselinkpilot", "https://github.com/TetraCoreHQ/linkpilot-cli", "https://github.com/TetraCoreHQ/linkpilot-mcp", "https://www.npmjs.com/package/linkpilot", "https://www.npmjs.com/package/@uselinkpilot/sdk", "https://www.npmjs.com/package/@uselinkpilot/mcp", "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "LinkPilot", "url": "https://uselinkpilot.com", "potentialAction": { "@type": "SearchAction", "target": "https://uselinkpilot.com/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://uselinkpilot.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://uselinkpilot.com/blog" }, { "@type": "ListItem", "position": 3, "name": "Is OneTimeSecret Safe? A 2026 Security Review", "item": "https://uselinkpilot.com/blog/is-onetimesecret-safe" } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "@id": "https://uselinkpilot.com/blog/is-onetimesecret-safe#article", "headline": "Is OneTimeSecret Safe? A 2026 Security Review", "description": "OneTimeSecret is open source and widely used. What its model protects, what it does not (revocation, audit trail, team controls), and when to use something else.", "datePublished": "2026-10-19", "dateModified": "2026-10-19", "image": "https://uselinkpilot.com/logo-512.png", "author": { "@type": "Organization", "name": "LinkPilot Team", "url": "https://uselinkpilot.com" }, "publisher": { "@type": "Organization", "name": "LinkPilot", "url": "https://uselinkpilot.com", "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://uselinkpilot.com/blog/is-onetimesecret-safe" } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is OneTimeSecret safe to use?", "acceptedAnswer": { "@type": "Answer", "text": "For a personal secret you would not mind one wrong person reading, yes. It is open source, it has run for years, and the secret is destroyed after the first view. Its documentation says secrets are encrypted on its servers, so the operator holds the key, and the hosted free plan has no revocation from a dashboard and no audit trail. For business credentials, pick a tool that gives you those." } }, { "@type": "Question", "name": "Is onetimesecret.com legit?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. onetimesecret.com is the hosted instance of the open-source OneTimeSecret project (github.com/onetimesecret/onetimesecret), with free and paid plans. As with any secret-sharing site, type the domain yourself rather than following a search ad, because lookalike clones have targeted this category." } }, { "@type": "Question", "name": "Can OneTimeSecret read my secret?", "acceptedAnswer": { "@type": "Answer", "text": "According to its own documentation the secret is \"securely encrypted on our servers\", which means the service receives the plaintext and encrypts it. Its homepage says that once a link is opened \"no one, including us, can retrieve it\". Adding a passphrase raises the bar; the documentation does not describe how the passphrase is stored, so we cannot say how much. If you need encryption that happens before the text leaves your device, use a tool that encrypts in the browser." } }, { "@type": "Question", "name": "Can I revoke or recall a OneTimeSecret link?", "acceptedAnswer": { "@type": "Answer", "text": "The hosted product shows the sender whether a secret was received or burned. Its public documentation does not describe recalling an unread link from a dashboard. If you need to pull a link back after sending it, choose a tool with revocation." } }, { "@type": "Question", "name": "What is a safer alternative to OneTimeSecret for a team?", "acceptedAnswer": { "@type": "Answer", "text": "A tool that encrypts in the browser, records each open on a timeline and lets you revoke a link. LinkPilot does those three on Pro; Password Pusher adds view caps and self-hosting; PrivateBin and Yopass encrypt in the browser and can be self-hosted. The best OneTimeSecret alternatives post compares ten." } } ] } ] ```