Your one-time secret link is ready
Expires in 1 day · 1 view
What is a one-time file?
A one-time file is a file you send through a one-time download link. The recipient can download it once by default, then the encrypted copy is permanently deleted. If you allow up to 10 downloads, it remains available only until the final download or expiry. It is the file-sharing equivalent of a self-destructing message: a one-time URL that disappears after the file lands.
Why use one-time encrypted file sharing?
Regular file sharing leaves copies sitting in chat history, email inboxes, and cloud folders for far longer than necessary. 1time.io is built for the opposite use case: deliver a one-time file, let the recipient download it, and remove it from the server. It works as a drop-in Firefox Send alternative for one-shot encrypted file delivery.
Encrypted before upload
The browser encrypts the file first. The server only receives encrypted bytes.
Optional passphrase
Add a second factor so the link alone is not enough to decrypt the file.
One-time download
Once the recipient downloads the file, the stored copy is deleted from the server.
Text Secret Sharing
Need to send a password, API key, or short note instead of a file? Use secure password sharing.
What secure file sharing is good for
This page is best for one-off handoffs: configuration exports, client certificates, NDA PDFs, database backups, screenshots with sensitive data, support bundles, and internal documents that should not live forever in Slack, email, or a shared drive.
Sending ID documents: passport, ID card, PAN or Aadhaar
A copy of a passport, national ID or tax card is enough to open accounts and pass identity checks in your name. Sent by email or chat, it stays in your Sent folder, the recipient's inbox, phone galleries, backups and forwarded messages for years. Send it here instead: the recipient downloads it once, the encrypted copy is deleted, and the conversation is left with a link that no longer opens. A one-time link cannot control what the recipient does with the file after downloading it, so send identity documents only when they are genuinely required.
Before you send any ID: share only the pages that were asked for, cover numbers the recipient does not need, and write the purpose and date across the copy, for example "For flat rental, 5 Oct 2026", so it is harder to reuse.
In India. UIDAI says you can use Aadhaar freely to prove your identity, with the same care you give your bank account or passport details, and that you should not post it on public platforms. Where the full number is not required, share a masked Aadhaar, which shows only the last four digits; you can download it from the official Aadhaar site. For online verification you can give a 16-digit Virtual ID instead of the number, and you can lock your biometrics. Never share an Aadhaar OTP. Share your PAN card only where it is genuinely required, such as banks, employers and tax filings.
How the encrypted file flow works
Choose a file, optionally add a passphrase, and create the link. The browser packs the file together with its metadata, encrypts the whole payload locally, and uploads only the encrypted blob. The recipient gets a one-time download link. On open, the browser decrypts the file locally and the server deletes the encrypted copy after the final allowed download.
A Firefox Send and WeTransfer alternative for one-time files
If you used Mozilla Send (Firefox Send) before Mozilla shut it down, or you reach for WeTransfer to move a sensitive file, 1time.io covers the same one-time file transfer need with stronger guarantees. Firefox Send was discontinued in 2020; 1time.io is an actively maintained, open-source replacement. Unlike WeTransfer — which stores files in a form the company can read — every file here is encrypted in your browser before upload, delivered through a one-time download link, and destroyed after the final allowed download or expiry. It works for one-time file sharing, one-time file transfer, and one-time download links without any account.
Key terms, briefly defined
- One-time download link
- A URL that delivers a file once by default. If the sender allows more downloads, the encrypted file is permanently deleted after the final allowed download or when it expires.
- Browser-side file encryption
- Encryption performed entirely in the sender's browser using AES-256-GCM via the Web Crypto API. The file never leaves your device in plaintext form.
- Encrypted file metadata
- Filename, MIME type, and size are bundled inside the encrypted payload — not stored separately on the server. The server cannot tell what was sent or how large the original file was.
- Self-destructing file
- A file that is automatically deleted after its final allowed download or when the expiry timer fires, whichever comes first — leaving no copy on any server.
Frequently asked questions
How does secure file sharing work on 1time.io?
Your file is packed and encrypted in the browser before upload. The server stores only encrypted bytes. The download link works once by default. When you need to send the file to a few people, you can allow up to 10 downloads. The encrypted file is deleted after the final allowed download or when the expiry time is reached.
Can the server see my file name or contents?
No. The file contents and file metadata stay inside the encrypted payload. For now, the filename, MIME type, and size are not stored separately on the server.
Can I protect the file link with an extra passphrase?
Yes. Add an optional passphrase when creating the link. The recipient will need both the link and that passphrase to decrypt the file.
What files can I send securely?
Any file up to 250 MB: PDFs, photos and scans of a passport or ID card, contracts, certificates, archives, configuration exports and screenshots.
Is WhatsApp or email safe for sending ID documents?
WhatsApp encrypts messages end to end and email usually travels encrypted, so interception is not the main risk. What stays behind is: the document remains in both chats or mailboxes, in backups, and it can be forwarded. Send a one-time link instead, and the conversation holds only a link that no longer works.
What if the wrong person opens the link?
By default the link works once. If your recipient tells you it no longer opens, someone else got there first and you know straight away. To prevent that, add a passphrase when you create the link and give it to the recipient by a different channel, for example by phone.