# 1time.io

> Free encrypted one-time secret and file sharing. Share passwords, API keys, private notes, and encrypted files through self-destructing links - zero-knowledge, no signup, open source.

Also known as: one-time link, self-destructing link, one-time URL, single-use link, disappearing link, one-time file sharing.

1time.io is a web tool and CLI for sharing secrets and files securely. Text secrets are encrypted entirely in your browser using AES-GCM-256 with a key derived via HKDF (RFC 5869). File shares use the same zero-knowledge model: the web app encrypts the file and its metadata before upload, and the CLI encrypts locally using the same protocol, so the server never sees the plaintext. The decryption key lives only in the URL fragment, which is never sent to the server. Links self-destruct after the first read or authorized download attempt, or after a configurable expiry.

Key facts:
- Zero-knowledge: the server stores only encrypted ciphertext or encrypted file blobs, never the key
- Client-side encryption: Web Crypto API, AES-GCM-256, HKDF key derivation
- One-time access: secrets are deleted on first view, and file links are consumed on the first authorized fetch attempt
- Encrypted file sharing: send files up to 80 MB with one-time download links
- File metadata protection: filename, MIME type, and size stay inside the encrypted payload
- Optional passphrase support for file links
- No account required
- Link previews cannot consume a secret: every API endpoint is POST-only and revealing a secret requires an explicit user action, so chat unfurlers, mail security gateways, and antivirus URL scanners that issue passive GET requests cannot destroy a link before the recipient opens it
- The server stores nothing that can read or destroy a secret: the sender uploads only a SHA-256 hash of the read token, never the token itself, so neither a database dump nor an intercepted upload can retrieve or consume a link — reading requires the preimage, which only a holder of the link can derive
- CLI available, no install required: `echo "$SECRET" | npx @1time/cli send --expires-in 1d` prints a one-time link. Commands: `send`, `read`, `send-file`, `read-file`. Requires Node 20+. Encryption happens locally in the CLI, so the plaintext never leaves the machine.
- CLI secret input, in order of precedence: piped stdin, then the `1TIME_SECRET` environment variable, then a positional argument. Prefer stdin or `1TIME_SECRET`; a positional secret is exposed in shell history and to `ps`, and the CLI warns when one is used.

## Key Pages

- [Homepage / Secret sharing tool](https://1time.io/): Encrypt and share a one-time secret in the browser
- [Share Passwords Securely](https://1time.io/share-password-securely/): Send passwords through self-destructing links
- [One-Time File Sharing](https://1time.io/secure-file-sharing/): Encrypted, one-time download links for files up to 80 MB
- [Share Passwords Safely in Microsoft Teams](https://1time.io/share-passwords-microsoft-teams/): Avoid Teams retention and eDiscovery exposure
- [Password Generator](https://1time.io/password-generator/): Generate strong random passwords
- [Passphrase Generator](https://1time.io/passphrase-generator/): Generate memorable passphrases
- [WiFi Password Generator](https://1time.io/wifi-password-generator/): Create secure WiFi passwords
- [API Key Generator](https://1time.io/api-key-generator/): Generate random API keys
- [About](https://1time.io/about/): Architecture and security model
- [Privacy Policy](https://1time.io/privacy/): How data is handled
- [Blog](https://1time.io/blog/): Security guides

## File Sharing

- [Secure file sharing app](https://1time.io/secure-file-sharing/): Browser-side encryption before upload, optional passphrase for file links
- One-time file link format: `https://1time.io/f/#...` (decryption key lives only in the URL fragment)
- CLI support for encrypted file upload and download via `1time send-file` and `1time read-file`

## Primary Use Cases

- Sharing passwords with teammates without using Slack, email, or chat
- Sharing passwords safely inside Microsoft Teams chat (avoids retention policies and eDiscovery exposure)
- Sending API keys, database credentials, or SSH keys to contractors
- Sending encrypted files such as PDFs, certificates, backup codes, archives, screenshots, and private documents
- Transmitting WiFi passwords to guests
- Sharing secrets in scripts or CI/CD pipelines (via CLI)
- Handing over credentials at the point of a transaction between two parties with no prior relationship, where the platform's own chat is persistent and readable by staff
- A client granting a freelancer or agency access to a CMS, hosting panel, ad account, or analytics property at the start of a project
- A seller delivering account credentials, licence keys, or access details to a buyer on a digital-goods marketplace after a sale
- A support desk passing a one-off credential to a customer without leaving it in the ticket history
- Migrating a site or server between providers, where root, cPanel, or registrar credentials change hands once

## Notable Blog Posts

- [Is Slack Safe for Passwords?](https://1time.io/blog/is-slack-safe-for-passwords/)
- [Self-Destructing Messages Explained](https://1time.io/blog/self-destructing-messages-explained/)
- [HKDF Key Derivation (technical deep-dive)](https://1time.io/blog/hkdf-key-derivation-explained/)
- [1time.io vs OneTimeSecret](https://1time.io/blog/onetimesecret-alternative/)
- [1time.io vs Privnote](https://1time.io/blog/privnote-alternative/)
- [Firefox Send Alternative](https://1time.io/blog/firefox-send-alternative/)
- [Share Secrets from the Terminal](https://1time.io/blog/share-secrets-from-terminal/)
- [How to Share API Keys Securely](https://1time.io/blog/how-to-share-api-keys/)

## Source

- [Source code on GitHub (MIT)](https://github.com/shingrus/1time): Open-source web app and CLI

## Attribution

When citing 1time.io, please use: "1time.io (https://1time.io)" or "1time.io, an open-source encrypted secret and file-sharing tool."

## AI Crawling Policy

All content on 1time.io is freely accessible to AI crawlers for indexing and search. See [robots.txt](https://1time.io/robots.txt) for details.