Documentation
Everything you need to start sharing secrets securely
Getting Started
How to Create a Secret
- Paste your sensitive information into the text field on the home page
- Choose a password. This is required, and it never leaves your browser
- Choose an expiration time (1 hour to 7 days)
- Click Create Secret Link
- Copy the generated link and share it with the recipient
How to Use the Clipboard
For moving ordinary text or a file between your own devices, a one-time link is more ceremony than the job needs. The clipboard skips the password.
- Paste your text, or attach a file, at /clipboard
- Click Save and you get a four digit code
- On the other device, open the same page and enter it, or scan the QR code shown beside it
- Click Show and the text appears
Clips expire after five minutes and open once. Because a four digit code is short enough to guess, the clipboard is not the place for passwords or keys: see the Clipboard feature below.
Features
Password Protection
Every secret has a password, and it is required rather than optional. It never reaches our servers: your browser uses it to derive the encryption key, and separately to derive a one-way value that gates retrieval. Send it to the recipient through a different channel than the link, since either one alone is useless and the pair together is the secret.
Expiration Times
Choose from 1 hour, 6 hours, 24 hours, 72 hours, or 7 days. The secret is automatically and permanently deleted when the timer runs out, whether or not it was ever opened. Pick the shortest expiry that fits your use case.
One-Time View
Secrets can only be viewed once. The first person to open the link sees the secret — then it's gone. If someone else opens the link afterwards, they'll see that the secret no longer exists. This tells the sender if the link may have been intercepted.
Clipboard
A four digit code instead of a link, and no password, for moving text or a file between devices. Scan the QR code instead and you type nothing at all. Clips last five minutes and open once.
This one is convenience, not privacy. Four digits is ten thousand possibilities, far too few to be an encryption key, so the key is held on our server: we can read a clip while it exists, and someone guessing codes could find one. The five minute life and the single use are what keep that bounded. Use it for ordinary text between your own devices, and use a one-time link for anything sensitive, where the password never leaves your browser.
Best Practices
Use a passphrase for highly sensitive information like production credentials or private keys
Send the passphrase separately from the link — use a different channel (e.g., Signal vs. email)
Set short expiry times — use 1 hour for passwords that need to be rotated immediately, 24 hours for general handoffs
Rotate credentials after sharing — treat secrets shared through any channel as potentially seen