What is a one-time secret link, and when to use it
A one-time secret link holds an encrypted secret that is deleted from the server the first time someone opens it. It exists so you can hand over a password, a token or sensitive text knowing that afterwards there is nothing left to leak: not on the server, and not in the inbox it travelled through.
How it works
- 01You paste the secret and your browser encrypts it with AES-256-GCM before anything is sent.
- 02The server receives only ciphertext, an initialization vector and the expiry.
- 03The link is built with the key after the #, so the key never reaches the server.
- 04The recipient opens the link, their browser downloads the ciphertext and decrypts locally.
- 05The record is deleted at that point: the same link never works a second time.
One-time read or time-based expiry
They are not the same thing, and they combine. One-time reads give you a clear signal: if the link is already dead when the recipient opens it, somebody got there first. Time-based expiry is more forgiving when you don't control when they will read it.
| MODE | BEST FOR | WATCH OUT FOR |
|---|---|---|
| One-time read | One person, one credential, immediate confirmation | An automatic link preview can consume it |
| Time-based expiry | Different time zones, out-of-hours handovers | It stays reachable until the window closes |
| Both together | The usual case: burns on read, expires if nobody opens it | Pick the shortest realistic window |
What you can share this way
- Account passwords, WiFi passwords, or the password to an encrypted file.
- API tokens, deploy keys and connection strings.
- Recovery codes and two-factor seeds.
- One-off personal data that shouldn't sit in a chat history.
- Short confidential notes: internal instructions, an account number, an identifier.
SecureShare accepts up to 4,000 characters per secret, so a block of text fits, a document does not. For files, encrypt the file and share its key here.
Where the limits are
- If you lose the full link, the secret is unrecoverable: the key lived in the fragment and nobody else has it.
- One-time reads protect storage, not the recipient's device: once decrypted, the secret is on their screen.
- Some mail clients and chat apps fetch links to build previews; if that happens, generate a new one.
- It doesn't replace a password manager for credentials in daily use: it is a delivery channel, not a vault.
- Rotating the password after handover is still a good idea for sensitive access.
If the link fails on the first try, assume something or someone opened it and treat the secret as compromised.
No accounts, no needless trail
No account is needed to create or open a link, so the secret is never tied to a user profile. You can read exactly what is stored, and for how long, in the privacy policy, and the cryptographic detail in the security guide.
