Client-Side Link Encryption (Zero-Knowledge).
The decryption key is embedded in the URL # fragment. Because browsers never send the # fragment to the server over HTTP, neither we nor anyone intercepting server traffic can ever decrypt your message.
AES-256-GCMZero-knowledgeOne-shotOpen Source
Send a password. Read once — gone forever.
Passwords, API keys, card numbers — via encrypted self-destructing link.
0 Bytes / 20 KB
Start typing to create a link
Browser encryptionSplit-linkOne-shot
Learn more about Secure Link
How to Share a Password or Secret via a One-Time Link
Enter your secret.
Paste a password, API key, recovery phrase, or confidential note into the generator above.
Set expiration rules.
Choose a time-to-live (TTL from 1 minute to 24 hours), view limit, and an optional password for two-factor link encryption.
Share the secret link.
Your data is encrypted locally in your browser using AES-256-GCM. The moment the recipient views the note, it is permanently wiped from the server.
Why Our Secret Link Generator Is Safer Than Chat or Email
Messenger Preview Protection.
Chat apps like Slack, Telegram, WhatsApp, and Discord automatically crawl links to generate previews. While standard services accidentally burn your note during link preview, Secure Link requires explicit human interaction before decrypting and destroying the secret.
Burn-on-Failure Protection.
When you protect a temporary link with a custom password, failed decryption attempts consume available views or immediately destroy the payload — stopping brute-force attacks cold.
Decoy Mode (Plausible Deniability).
Set a secondary decoy password alongside your real one. If forced to reveal your passphrase, the decoy password displays a harmless fake note while keeping your real secret hidden.
One-Time Link vs. Temporary Link: What Is the Difference?
| Feature | One-Time Link (Burn After Reading) | Temporary Link (Time-Limited) |
|---|---|---|
| Deletion Trigger | Destroyed immediately after 1 view | Expires automatically when the timer runs out |
| Lifespan (TTL) | Until opened (up to 24 hours max) | Configurable from 1 minute to 24 hours |
| Tamper Detection | Acts as a digital seal — if intercepted, the intended recipient sees the link is already gone | Can allow multiple views within a strict time window |
| Best Used For | Sharing passwords, .env secrets, 2FA backup codes, and private keys | Short-term team credentials or time-sensitive instructions |
Secure Link combines both: your secret link self-destructs right after the first view, and if left unopened, automatically purges itself when the TTL expires.
Frequently Asked Questions
How do I share a password securely online?
Never send plain-text credentials together with the username in the same channel. Put the password itself into the one-time link generator, set it to expire after 1 view, and send the link via chat while sharing the username or context separately.
Can CreateSecureLink read my encrypted messages?
No. Encryption and decryption happen entirely inside your web browser using the Web Crypto API (AES-256-GCM). Only ciphertext reaches our temporary memory store, and the decryption key stays inside your URL # fragment, which never leaves the client.
What happens if someone intercepts the secret link?
Because a one-time link can only be opened once, it acts as a tamper-evident seal. If an unauthorized party opens the link first, the secret is permanently burned. When your intended recipient clicks the link and sees it has already been viewed, you immediately know the credential was compromised and can rotate it.
Why shouldn't I send passwords in Slack, Teams, or email?
Messages in email and workplace chats are stored indefinitely, indexed for search, and backed up across cloud servers. A single compromised account months later exposes every password ever pasted into chat history. Self-destructing links leave zero permanent footprint.
Are deleted notes or IP addresses logged?
Encrypted payloads are permanently erased from volatile storage (Upstash Redis) the instant they are read or when their TTL expires — no backups exist. We never associate IP addresses with specific notes, meaning deleted secrets cannot be recovered under any circumstances.
Is the code open source?
Yes. You can inspect our client-side encryption logic, threat model, and URL fragment handling directly to verify that keys never touch our servers.