Share a password through a link that reveals it once and then destroys itself.
No account needed. Free forever plan.
Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
One URL. The key after the # stays in the browser and never reaches our servers.
The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.
Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.
This page is about sharing a password a single time, not about the six-digit codes an authenticator app generates. You have a credential, someone else needs it, and you want no copy to survive the hand-off. The creator above makes a link that does exactly that: the recipient opens it, reads the password, and the stored ciphertext is overwritten in the same step.
Your browser encrypts the text with AES-GCM-256 and keeps the key in the link after the #. The server receives ciphertext and a random slug. When the recipient opens the link, a plain page load only checks the status; pressing reveal is what returns the ciphertext and marks the secret as burned, atomically, so two people opening the link at once cannot both read it. Their browser decrypts the text with the key from the link.
A second visit by anyone gets a burned page with HTTP status 410, which tells browsers and caches the content is gone for good.
Unopened anonymous links expire after seven days. With a free account you can choose one hour, 24 hours or seven days and revoke a link from the dashboard. Pro adds a passphrase, a custom expiry date and time, and an audit timeline, so a credential shared once is also a credential you can prove was opened once.
Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.