About Oncebin

Oncebin lets you create and share one time secrets.

Oncebin is a free, zero-knowledge tool for sharing passwords, API keys, and other sensitive text without leaving them sitting around in chat logs, email inboxes, or ticketing systems. You create a one-time link, send it, and once opened the secret is permanently destroyed.

No signup, no accounts, no tracking. Encryption happens entirely in your browser — our servers never see your secrets in plain text.

Common Use Cases

  • Onboarding — Send initial passwords or credentials to new team members.
  • DevOps — Share API keys, database connection strings, or environment variables.
  • Client handoffs — Pass login credentials to freelancers or clients without email trails.
  • IT support — Send temporary passwords or WiFi credentials to end users.
  • Automation — Use the CLI script, API, or SKILL.md to integrate into your workflow.

FAQ

What happens when someone opens my link?

The encrypted secret is fetched once, decrypted in the browser, and immediately marked as burned. After that, the same link will only show that the secret has already been viewed or has expired.

How long are secrets kept?

All secrets are automatically deleted after 30 days.

Can Oncebin see my secrets?

Secrets are encrypted in your browser before they are sent to Oncebin. The server only stores the encrypted blob and never sees the plaintext. The decryption key lives in the URL fragment and is never sent to the server.

Is this a password manager?

No. Oncebin is designed for short-lived sharing, not long-term storage. Use a dedicated password manager for ongoing storage of your secrets.

Security Overview

Oncebin is built around a simple principle: store as little as possible, for as short a time as possible. Encryption happens client-side using modern browser crypto APIs before any data reaches our database.

  • Secrets are encrypted in your browser using a randomly generated key.
  • The encryption key is embedded in the URL fragment, which is not sent to the server.
  • Encrypted secrets are deleted after a single successful read or when they expire.
  • We track aggregate counters (like total secrets revealed) but never store plaintext content.

Like any tool, Oncebin should be one part of your security story. Use unique passwords, enable multi-factor authentication where possible, and treat secret links as you would any other sensitive information.

Oncebin is open source. View on GitHub

Have questions or feedback? Get in touch