AES-256-GCM · ZERO-KNOWLEDGE · ONE VIEW ONLY

Send secrets
that disappear.

Zero-knowledge password and photo sharing. Encrypted in your browser. The key never touches our servers. Every secret burns after one view.

  • Encrypted on your device before anything is sent
  • We store ciphertext only — never the key
  • Opened once, then deleted for good
encrypted in this tab
Expires after
Viewer timer

No countdown — the secret stays on screen until the viewer leaves.

Log in to keep a history of who you sent secrets to and see where they were opened.

Burns after one view — even if it hasn’t expired yet.

Encrypted in your browser before anything is sent.

THE PROBLEM

A password you paste is a password you keep sharing.

Drop it into Slack, an email or a support ticket and it stays there — searchable, forwardable and backed up long after anyone needs it. OnePass gives every secret exactly one reading. Then there’s nothing left to find.

#devops · chatSTILL SEARCHABLE

here’s the prod db login → Pr0d!x92

Re: server access · emailFORWARDED 3×

Admin password is Adm1n#2026 — don’t share it

SUP-1042 · ticketIN EVERY BACKUP

API key for the vendor: sk_live_9fA2…

OnePass · secretBURNED

Prod db login → Read once. Gone.

HOW IT WORKS

Follow one secret from paste to burn.

Six steps, start to finish. Watch where the secret goes — and where the key never does.

Your browserSENDER
PLAIN TEXT
db_pass = Pr0d!x92
ciphertext →
OnePass serverSTORAGE
NOTHING STORED
—
never sees the key
ciphertext →
Their browserRECIPIENT
WAITING
—
the key travels inside the link — sender to recipient, never through OnePass
STEP 1 / 6Write

You paste a password, API key or note — or drop in a photo. Nothing has left your device yet.

WHY TEAMS CHOOSE ONEPASS

Built so there’s nothing to leak.

Every design decision removes something an attacker — or a careless inbox — could get hold of.

Zero-knowledge

Encryption happens in your browser with AES-GCM. We only ever store ciphertext. The decryption key lives only in the link you share.

Burn after reading

One-time links are destroyed the moment they are opened. Set automatic expiry for 1 hour, 24 hours, or 7 days.

Photos & files

Share screenshots, config files, or short notes. Everything is encrypted client-side before it leaves your device.

Know when it’s opened

Your dashboard shows every secret you’ve sent and whether it has been opened — without ever showing the secret itself.

END-TO-END ENCRYPTION

Locked on your device.
Unreadable everywhere else.

Every password, API key, note, photo and file is encrypted with AES-256-GCM in your browser before a single byte is uploaded. OnePass only ever stores scrambled ciphertext — we couldn’t read your secrets even if we wanted to.

  • A fresh 256-bit key for every secret. Generated in your browser, never reused.
  • Key travels only in the link. It sits after the #, which browsers never send to any server.
  • Tamper-proof. GCM authentication rejects any ciphertext that has been altered.
  • Deleted on first view. The ciphertext is erased the moment it’s opened, or when it expires.

Your next password shouldn’t
outlive the conversation.

Encrypted in your browser. Read once. Gone for good.

Send a secret →Log in to your dashboard