Skip to main content
nullpaste

One-time secret

Share a secret with a link that works once

Paste a password, API key or recovery code below. It's encrypted in your browser, the link opens exactly once, and then the secret is gone. No account, free.
Size: 0 B / 1 MB
Privacy options
  • Encrypt in browser: content is encrypted with AES-256-GCM before upload. The key is added to the share link after “#” and never sent to the server — lose the full link and the paste can't be decrypted.
  • Burn after read: the paste is deleted after the first confirmed view — readers are asked to confirm before it opens.

Ctrl+Enter to create · delete code shown once

Encrypt in browser and burn after read are already on. Unread links expire after 1 week — change it above if you need less.

How to share a one-time secret

  1. 1

    Paste the secret

    Drop in the password, token, .env line or recovery code. Up to 1 MB of text.

  2. 2

    Keep encryption and burn-after-read on

    They're switched on for you. Optionally add a password and pick a shorter expiry.

  3. 3

    Create the link and send it

    Copy the full link — the decryption key is in the part after #, so a truncated link can't be opened. Send it only to the person who needs it.

  4. 4

    It burns after one view

    Your recipient confirms, reads the secret, and the content is deleted. Anyone opening the link afterwards sees that it has burned.

Why not just paste the password into chat?

A password sent in Slack, Teams, email or a ticket stays there: in message history, in search, in backups, and on every device that synced it. Months later it can still be found by anyone who gets into one of those accounts.

A one-time link keeps the secret out of all of that. The chat only ever contains a link, and once your recipient has opened it, the link is dead — the secret no longer exists anywhere to be found.

What NullPaste can and can't see

With Encrypt in browser on, your browser generates a fresh 256-bit key, encrypts the secret with AES-256-GCM, and uploads only the ciphertext. The key is added to the share link after #key= — the part of a URL browsers never send to a server. NullPaste, its logs and its backups only ever hold data they cannot decrypt.

With Burn after read on, reading requires an explicit click, exactly one request can claim the paste, and its content is wiped as it is read. For 30 days afterwards the link shows a “burned” notice, so a second visitor learns it was already opened. Full security details.

Good practice for sharing credentials

  • Send the link and any password over two different channels.
  • Use the shortest expiry that works — an hour is often enough for a colleague who is online.
  • One link per person; never forward a one-time link.
  • Remember the recipient can still copy what they read — rotate shared credentials when someone leaves.
  • Scripting it? The NullPaste API creates burn-after-read pastes from curl with no API key.

Frequently asked questions

What is a one-time secret?

A one-time secret is a link that reveals a piece of sensitive text — a password, API key, or recovery code — exactly once. After it has been opened, the content is deleted and the link only says it has burned, so the secret doesn't linger in chat history, email, or anyone's inbox.

Is a one-time secret link safe?

With encryption on, the secret is encrypted in your browser with AES-256-GCM before it is uploaded, and the key lives only in the part of the link after #, which browsers never send to a server. NullPaste stores only ciphertext it cannot read. The main risk is the link itself: anyone who gets it first can open it, so send it only to the intended person.

Will Slack, Teams or iMessage link previews burn my secret?

No. Opening a burn-after-read link shows a confirmation screen first, and nothing is revealed or deleted until a person clicks to read it. Link-preview bots only load that screen, so the secret survives until your recipient opens it.

How can I tell whether my secret has been read?

Open the link yourself but don't confirm. If you see the confirmation screen, it is still unread. If the page says the paste has burned, someone has opened it — and if your recipient says it wasn't them, treat the secret as exposed and change it.

What happens if nobody opens the link?

It expires on the timer you chose — 10 minutes, 1 hour, 1 day or 1 week (this page starts at 1 week) — and is then deleted unread. Pick the shortest window that gives your recipient enough time.

Can I send one secret to several people?

Not with one link — the first person to open a burn-after-read link destroys it. Create a separate one-time link for each recipient.

Should I add a password too?

For high-value secrets, yes: tick Password and send the password over a different channel (for example the link by email, the password by phone or SMS). Then intercepting the link alone isn't enough. The password is checked with Argon2id on the server.

Do I or the recipient need an account?

No. There is no account system at all — create the link, share it, done. The recipient opens it in any browser.