Share a secret.
Read once, then gone.

Passwords, API keys, notes and files, sent as a link that self-destructs. Your browser encrypts everything before it leaves your computer, so we never see the secret or the key. Free, no account.

Your secret Encrypted in this browser

Attach files or drop them here. Up to 10 MB in total, encrypted too.

Expires after

1 hour 1 day 7 days 30 days

Can be opened

1 time

Add a passphrase

Need a password from someone? Send them a request instead.

The key travels in the link. Never to us.

Browsers never send the part of a link after the # to a server. That is where your secret's key goes.

https://secretshare.co/s/e8YHRU7KXNPGikTc_00m7g#BitESeMj5NjfVKA1-Kc7X_Ue6hd2YBImKyZXAqiCDZY

Sent to our server The identifier. On its own it opens nothing: we hand the encrypted copy only to a browser that proves it holds the key.

Never sent The key, 256 random bits. It exists only in your browser, in the link, and in your recipient's browser.

Your browser encrypts It draws a random key and encrypts the secret with AES-256-GCM. Nothing has been sent yet.
We keep the encrypted copy Only encrypted bytes reach our server, padded so that their size doesn't give away the length of a password.
Read once, then gone The recipient presses and holds Reveal. Their browser decrypts the secret, and on the last allowed view we delete the encrypted copy.

You don't have to trust us with the secret, because we never have it. The security page describes each step, and the code that does it is served to your browser as readable files.

What protects your secret

Published, standard algorithms, run by your browser.

Encryption: AES-256-GCMIn your browser, with the Web Crypto API.
Key: 256-bitRandom, carried after the #, never sent to us.
Passphrase: Argon2id64 MiB, 3 passes. Ten wrong attempts destroy the secret.
Requests: X-WingML-KEM-768 (FIPS 203) with X25519.

Access proof: We hand the encrypted bytes only to a browser that proves it holds the key. Knowing a link's address without its key gets nothing.
Hidden length: Secrets are padded to fixed sizes, so the encrypted copy doesn't reveal how long your password is.
Link previews: Slack, Teams and email scanners can open the page: nothing is used up until a person presses and holds Reveal for a second.
Our servers: No access logs, no IP addresses stored, no third-party scripts, a strict Content Security Policy. Hosted in France.

Read the full specification

Need a password from someone? Send them a request.

Instead of asking a client to email a password, send them a request link. What they type is encrypted to a key that only you hold.

The key exchange uses X-Wing, which combines ML-KEM-768 with X25519, so a recorded answer stays protected even against future quantum computers.

Request a secret

You
Create the request Your browser makes a key pair and keeps the private half in your inbox link.
Them
Answer through the link Their browser encrypts the secret to your public key. We can't read it.
You
Open it once From your private inbox link, on your device. Then it is erased.

How it compares with other free tools

What you get without creating an account, on the tools people use most to send a password.

Free, no account	secretshare	onetimesecret	password.link	Privnote	Password Pusher
Encrypted in your browser: the server can't read it	Yes	No, server-side	Yes	Yes	No, server-side
Choose expiry and number of views	Yes	Expiry only	No	Expiry only	Yes
Passphrase	Yes, Argon2id	Yes	No	Yes	Yes
Attach files	Yes, 10 MB	No	No	No	No
Request a secret from someone	Yes	No, needs an account	No, needs an account	No	Not documented
Post-quantum key exchange for requests	Yes, X-Wing	No	No	No	No
No ads	Yes	Yes	Yes	No	Yes

Checked in October 2026 on each service's own website, documentation and published source code, for anonymous use without an account. Paid plans and accounts add more on some of them. Spotted a mistake? Tell us and we will fix it.

Questions

Can you read my secrets?

No. Your browser encrypts the secret before sending it, and the key stays in the part of the link after the #, which browsers never send to a server. We only ever hold encrypted bytes we cannot open.

What if Slack, Teams or Outlook opens the link first?

Nothing is lost. Opening the page reveals nothing and uses up no view. To reveal the secret, a person has to press and hold the button for a second: link previews never run the page, and the email scanners that do click buttons don't hold them. For complete certainty, add a passphrase: no scanner can type it.

What happens after the secret is read?

On its last allowed view, the encrypted copy is deleted from our database in the same transaction that hands it over. What remains until the expiry date is a receipt: when it was read, never what it said.

How do I know the secret was received?

When you create a secret, you get a private tracking link. It shows whether and when the secret was opened, and lets you burn it early. No account needed.

Why add a passphrase?

If the link leaks, say in a forwarded email, the passphrase still protects the secret. Send it through a different channel. Ten wrong guesses destroy the secret, so it can't be brute-forced.

What does post-quantum mean here?

Secret links use AES-256 with a key that never travels over the network, which is already considered safe against quantum computers. Requests are different: they rely on public-key cryptography, which future quantum computers could break. That is why requests use X-Wing, which combines the ML-KEM-768 standard with the classic X25519.

Is it really free?

Yes. No account, no ads, no trial. Sharing and requesting secrets is free.

Who runs secretshare?

Kiora, a software company in Puteaux, France. The servers are ours and they are in France. See the legal notice.

Got a password to send?

Paste it, choose when it expires, send the link. No account, nothing to install.

Share a secret