onetimesecret

Onetime Secret — Secure One-Time Message Sharing

Keep passwords and other sensitive information out of your inboxes and chat logs.

A onetime secret is a link that can be viewed only once — a single-use URL. When you share sensitive info like a password over email or chat, copies linger in many places. Onetime links self-destruct after viewing, so only the intended recipient ever sees the contents.

Try it live at OnetimeSecret.com →

Quick Start (Docker)

# 1. Start Redis
docker run -p 6379:6379 -d redis:trixie

# 2. Generate and store a persistent secret key — back this up safely
openssl rand -hex 32 > .ots_secret && chmod 600 .ots_secret

# 3. Run Onetime Secret (set SSL=true for production)
docker run -p 3000:3000 -d \
  --name onetimesecret \
  --add-host=host.docker.internal:host-gateway \
  -e REDIS_URL=redis://host.docker.internal:6379/0 \
  -e SECRET="$(cat .ots_secret)" \
  -e HOST=localhost:3000 \
  -e SSL=false \
  onetimesecret/onetimesecret:v0.26.12

Open http://localhost:3000, then create an admin ("colonel") account — it prints a generated password and is verified immediately:

docker exec onetimesecret bin/ots customers create [email protected] --role colonel

[!IMPORTANT] Losing your SECRET key is not recoverable. It makes existing secrets unreadable among other things, so back it up.

Going further

• Self-hosting — reverse proxy, full authentication (PostgreSQL + RabbitMQ, MFA, WebAuthn), and production hardening: Self-Hosting Guide
• Docker Compose — simple and full stacks: docker/README.md
• Configuration — .env.reference and config defaults
• Contributing — from clone to a green test suite in two commands, plus test accounts & API tokens: CONTRIBUTING.md

Community & Support

• Get help — Documentation · Report an issue · Support
• Project — Latest Release · Docker Hub · Build Status
• Policies — Security · Code of Conduct
• See also — Similar services & alternatives

AI Development Assistance

Onetime Secret was developed with help from AI tools for architecture design, code generation, and documentation. As project maintainers, we remain responsible for all design decisions and the final code, and believe in being transparent about the tools involved.

License

MIT — see LICENSE.txt.