Encrypted on your device
The browser generates a random key and encrypts the content with AES-256-GCM. The server only receives encrypted bytes.
Share securely. Leave no trace.
Create an ephemeral link for a password, a note or a file. Content is encrypted on your device before it leaves; the key travels in the URL fragment and never reaches our servers.
Create a secure linkFree, public and no registration. Maximum expiry of 7 days.
Encryption happens in your browser with WebCrypto (AES-256-GCM).
Share this full URL. It includes the key after the # symbol; without it the content cannot be recovered.
It will be sent by the server. The link contains the decryption key.
Keep it if you want to destroy the link before it expires. It cannot be recovered.
Do not publish the link. Anyone who has it can open it.
The browser generates a random key and encrypts the content with AES-256-GCM. The server only receives encrypted bytes.
The key lives in the # fragment of the URL. Fragments are not sent in HTTP requests, so the operator cannot read the secret.
Choose expiry and view limits. The server enforces them atomically so a link cannot be opened more times than allowed.
When a link expires or runs out of views, the encrypted content is removed from storage. A cron job also clears leftovers and technical metadata.
We cannot read your secrets, even if you ask us to. The key is not on the server and there is no recovery service.
Limits intended for reasonable personal and professional use. We may adjust them for security or capacity.
Any extension: .rdp, .zip, images, executables… The limit is size, not type.
No. SecretManager is public and free. Anyone can create a link and the recipient can open it without registering.
No. Content is encrypted in your browser and the key travels in the # fragment of the URL, which is not sent to the server. Without the full URL we cannot decrypt it.
There is no recovery. Neither we nor anyone else can decrypt the content without the key. Create a new link if you lose it.
Yes. Any file type is allowed because it travels encrypted. The limit is size (10 MB per file, 25 MB per link), not extension.
When it expires, when the views run out or when the creator uses the delete token. A cron job then removes the blobs and technical metadata.
Yes. Choose “1 view” when creating the link. The first GET consumes the view atomically; simultaneous requests cannot bypass the limit.