---
title: "Is OneTimeSecret Secure? What Its Docs Say | LinkPilot"
url: https://uselinkpilot.com/is-onetimesecret-secure
description: "Is OneTimeSecret secure? A plain reading of its own security pages: what is encrypted and where, what it does well, and where LinkPilot differs."
lang: en
---

# Is OneTimeSecret secure?

For a one-time secret, yes by its own documentation, with one open question: where the encryption happens.

## How it works

1. 01
   ### Paste a password, a key, or a file
   Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
2. 02
   ### Send the link
   One URL. The key after the # stays in the browser and never reaches our servers.
3. 03
   ### The stored secret is gone
   The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.

Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model (https://uselinkpilot.com/security-architecture).

## How OneTimeSecret says it protects a secret

Onetime Secret's security overview describes its model in brief: a secret is designed to be viewed once and then permanently destroyed, an unviewed secret can be burned, secrets are encrypted in transit and at rest across all plans, every secret carries an expiration, and an optional passphrase adds a layer the link alone cannot open. Its data protection page adds that transport is protected with TLS, that it aims to keep only the metadata needed to operate the service, and that you can choose the region where data is processed and stored. The homepage states that once the recipient opens the link the data is permanently destroyed and no one, including Onetime Secret, can retrieve it.

Those are the right properties for a one-time secret tool, and they are stated clearly.

## The one thing the documentation does not say

Neither the security overview nor the data protection page says where the encryption happens: in your browser before the secret is sent, or on Onetime Secret's servers after it arrives. The distinction decides whether the operator could read a secret while it is stored. Encryption at rest protects the database from someone who steals the disk; it does not by itself prevent the service that holds the key from decrypting the record. The pages also do not describe how a passphrase is processed or stored, and the expiry maximum is given only as a plan limit.

This is not an accusation. Onetime Secret is open source and self-hostable, so anyone who needs to know can read the code or run their own instance, which is a stronger guarantee than any marketing page. It is simply a question the hosted service's documentation leaves open, and if your threat model includes the operator, it is the question to ask.

## One time secret review: what it does well

It is simple, free for individuals and teams, open source, and self-hostable with a linked GitHub repository. Burn before view, passphrases and expiry cover the controls most people need. Choosing a data region is something few competitors, including LinkPilot, offer. For an occasional personal secret, or for a team that wants to run the service itself, it remains a sound choice.

## Where LinkPilot differs

LinkPilot answers the open question explicitly: the secret is encrypted in your browser with AES-GCM-256, the key is placed after the # in the link where browsers never send it, and our servers, database and edge hold ciphertext and no key. The code that does this ships in the MIT-licensed CLI repository with test vectors. The security architecture (https://uselinkpilot.com/security-architecture) page states the model and its limits, including that secrets created before 29 September 2026 were stored as plaintext until they expired and that an attached file's name, size and type are visible to us.

Around the secret, LinkPilot adds revocation from a dashboard, file attachments, team roles, and on Pro (https://uselinkpilot.com/pricing) a passphrase mixed into the decryption key and an audit timeline. What it does not offer is self-hosting or a data region choice; the OneTimeSecret alternative (https://uselinkpilot.com/onetimesecret-alternative) page and the full comparison weigh those trade-offs.

## Sources

1. Onetime Secret homepage: https://onetimesecret.com/
2. Onetime Secret: Security & Trust: https://docs.onetimesecret.com/en/security/
3. Onetime Secret: Data protection: https://docs.onetimesecret.com/en/security/data-protection/

Checked 29 October 2026. If these pages have changed since, the newer text wins.

## Try the alternative

No account needed. Free forever plan.

## Frequently asked questions

### Can OneTimeSecret staff read my secret?

### Is OneTimeSecret safe for passwords?

### Is OneTimeSecret open source?

### How is LinkPilot's model different?

### When was this checked?

Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans (https://uselinkpilot.com/pricing).

## Related

- OneTimeSecret alternative: https://uselinkpilot.com/onetimesecret-alternative
- One time secret: https://uselinkpilot.com/one-time-secret
- Privnote alternative: https://uselinkpilot.com/privnote-alternative
- LinkPilot vs OneTimeSecret, compared in full: https://uselinkpilot.com/compare/linkpilot-vs-onetimesecret

All use cases: https://uselinkpilot.com/use-cases

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Use cases",
        "item": "https://uselinkpilot.com/use-cases"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Is OneTimeSecret secure",
        "item": "https://uselinkpilot.com/is-onetimesecret-secure"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Can OneTimeSecret staff read my secret?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Its documentation says secrets are encrypted in transit and at rest and that nobody can retrieve a secret after it has been viewed. It does not say whether encryption happens in your browser or on its servers, so the honest answer is that the pages checked do not settle it. Self-hosting removes the question."
        }
      },
      {
        "@type": "Question",
        "name": "Is OneTimeSecret safe for passwords?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "For sending a password once with a short expiry and a passphrase, its documented controls are appropriate. Send the passphrase by a different route than the link, as with any tool of this kind."
        }
      },
      {
        "@type": "Question",
        "name": "Is OneTimeSecret open source?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Its documentation links to a GitHub repository for self-hosting. Read the repository's licence for the terms; the pages checked do not name one."
        }
      },
      {
        "@type": "Question",
        "name": "How is LinkPilot's model different?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Encryption happens in your browser and the key never reaches LinkPilot, so we cannot read a secret even with full database access. LinkPilot is hosted only and cannot be self-hosted."
        }
      },
      {
        "@type": "Question",
        "name": "When was this checked?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The Onetime Secret pages listed under sources were read on 29 October 2026. If they have changed since, the newer text wins."
        }
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro (yearly)",
        "price": "288",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "288",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency (yearly)",
        "price": "2988",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "2988",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus (yearly)",
        "price": "7980",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "7980",
          "priceCurrency": "USD",
          "billingDuration": "P1Y"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad",
      "https://addons.mozilla.org/en-US/firefox/addon/uselinkpilot/"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  }
]
```