Is a one-time secret really gone after one view?

Yes. The stored ciphertext is overwritten the moment the reveal succeeds, and the reveal and the burn happen in a single database operation. There is no restore, by design.

Can the link be opened by a bot before my recipient sees it?

No. Loading the page returns only the status of the secret. Only an explicit reveal returns the ciphertext and burns the secret.

How long does an unopened one-time secret last?

Seven days without an account. With a free account you can choose one hour, 24 hours or seven days; Pro adds a custom date and time.

How is this different from OneTimeSecret.com?

OneTimeSecret is an open-source, self-hostable tool; LinkPilot is a hosted service that encrypts in your browser and adds revocation, attachments and, on Pro, passphrases and an audit timeline. The onetimesecret alternative page and the full comparison set them side by side.

One time secret

Paste a password or note and get a link that reveals it once, then burns.

No account needed. Free forever plan.

How it works

01
Paste a password, a key, or a file

Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
02
Send the link

One URL. The key after the # stays in the browser and never reaches our servers.
03
The stored secret is gone

The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.

Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.

What a one-time secret is

A one-time secret is a piece of text, usually a password, a key or a short note, that can be read exactly once. It is delivered through a link. The first reveal shows the text and destroys the stored copy in the same operation, so the link cannot be opened a second time, by the recipient or by anyone who finds it later.

LinkPilot's version encrypts the text in your browser with AES-GCM-256 before it is sent. The key is placed after the # in the link, which browsers never transmit, so the server holds ciphertext and no key. That means we cannot read the secret, and neither can anyone who gets into our database.

How to create a one-time secret link

Type or paste the text above and press the button. Copy the link and send it by any channel. An unopened anonymous link expires after seven days. A free account lets you pick one hour, 24 hours or seven days and revoke a link from the dashboard; Pro adds a passphrase, a custom expiry date and time, and an audit timeline of every view and burn.

One time secret share: what the recipient sees

They open the link and see a page that asks them to reveal the secret, so a link preview or a security scanner cannot spend it by accident. After the reveal, the text is on their screen and gone from our storage. A second visit, by anyone, returns a burned page with HTTP status 410. If that happens before your recipient has read it, change the secret and send a new link.

Frequently asked questions

Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.

All use cases