Secret Once

Secret Once is a simple, privacy-first tool for sharing sensitive information—like passwords, credentials, or confidential notes—through one-time links that self-destruct after they’re viewed.

You paste your secret, choose an expiry (from minutes to days), optionally set a password, and send the unique link. Once the recipient opens it, the content is deleted from Secret Once’s servers, leaving no copies or backups behind. No account is required to use the free service.

Built by Onpipeline, the service emphasizes security and compliance: data is encrypted in transit and at rest, it’s hosted on AWS, and the company states alignment with GDPR/CCPA and SOC 2 principles. The privacy policy also notes that Secret Once does not use tracking, analytics, or third-party cookies.

For teams, Secret Once for Business adds white-label options (your domain and TLS certificate, logo, colors/CSS, custom footer), file attachments, and an API for creating links from your backend or intranet. The business page highlights modern TLS and an SSL Labs A+ rating.

Key features:

One-time access & auto-destruct: Secrets can be opened only once; then they’re permanently removed. You can also set an expiry window (e.g., 5 minutes to 7 days). Optional password protection: Add a password to the link for an extra layer of control. No registration required: Use the core service without creating an account. Privacy-first operations: No tracking/analytics cookies; content is designed to be destroyed and not retained. Business & white-label: Your domain and branding, plus file attachments (e.g., PDF, DOC, PNG) and an API (headers x-domain, x-api-key) for server-side link creation. File uploads are base64, up to 3 MB, with common formats supported. Comparative security stance: Unlike email or cloud storage, Secret Once is designed not to retain content or related metadata after access.

Typical uses: sharing passwords or API tokens, handing off client credentials, sending short-lived files, or delivering one-time messages to customers, partners, or colleagues—without leaving traces in email threads or chat logs.