One-Time Secret

Share passwords and sensitive data with client-side encryption and burn-after-reading.

Create a secret

Secret content

Encrypted in this browser before anything is sent. 0 / 10,000

Expires after 24 hours

1 hour7 days

Whichever comes first: one viewing, or this deadline.

Passphrase (optional) The recipient types this before the secret is released. Send it by a different channel to the link — a passphrase in the same email is decoration.

Withhold the key from the server True zero-knowledge: the decryption key stays in the link's # fragment and is never posted. Costs you the short link — you get the full-length URL, and it stops working if anything strips the fragment.

How it works

Encrypted in your browser

AES-256-GCM via the Web Crypto API, with a fresh 256-bit key and a fresh 96-bit nonce per secret. The plaintext never leaves this tab.
Stored as ciphertext

itsyots.au holds the ciphertext, the nonce and the auth tag. Our server is a proxy — it forwards them and keeps nothing.
Where the key goes

By default the key is posted with the ciphertext, because that is the only way the service can build the short link — so itsyots.au could decrypt the secret. Tick withhold the key above if that is not acceptable for what you are sending; the key then exists only in the link fragment, which browsers never transmit.
Burned after one read

The first successful retrieval deletes the stored copy. Anything still unread at the expiry deadline is deleted too. There is no undo and no second viewing.

Retrieve a secret

Paste a full secret link — everything after the # included — or an itsy.au short link. Retrieving destroys the server's copy, so only do it when you are ready to read it.

Secret URL

Before you send it

The link is the secret. Anyone who sees it — a forwarded email, a shared Slack channel, a screenshot in a ticket — can read what is behind it, once. Send it to one person, and keep the passphrase on a different channel.

One read, then gone. If the recipient says the link is dead, something already opened it — assume the secret is burned and rotate it.
Link previewers count as a read. Some chat and mail clients fetch links to build a preview card. If that happens the secret is consumed before a human sees it; a passphrase protects against it.
Rotate anything you send here. This is a delivery mechanism, not a vault.