Generate a strong password
Choose length and character types.
Generated in this browser. Copy places the password on your clipboard; this page cannot clear it. The PFX preset changes character options only.
One-time link
One-time URL sharing is disabled.
Checked: send the key separately. Unchecked: the link includes the key, so anyone with the link can try to reveal the password.
This blocks ordinary page selection and copy shortcuts on the reveal control, but cannot stop browser tools, extensions, screenshots, or a receiving app from retaining dragged text. Drag data can be accepted by other apps too.
One-time link
Decryption key · send separately
Copy only when ready. Clipboard is not cleared automatically; if copy fails, select and copy the value.
Open your one-time secret
Reveal this link once. After it opens, the link can no longer be used.
The drop target receives plaintext and may retain it.
Encrypted in your browser · 4 KiB max · one reveal · expires in 5 minutes. Scanners or a wrong key can use the link. No recipient identity check. Avoid high-impact secrets.
Technical test (synthetic only)
Synthetic API demonstration
This flow is disabled unless this page is explicitly configured for the same-origin /api endpoint. When enabled, it can share only a fixed synthetic marker, never a password or customer text. It is not for customer use.
The pilot API is not configured. Sharing is disabled.
Synthetic test link
Separate synthetic decryption key
A synthetic share link was opened. Its fragment has been removed from the address bar. Enter the separately supplied synthetic key and explicitly reveal to test the API.
The server contract uses a fixed synthetic marker and a simulated verification transition. It does not authenticate a recipient or support real secrets. Link identifiers appear only in the URL fragment; the decryption key is separate and is never sent to the API. Browser history, extensions, screenshots, and copied links still require care.
Privacy and limits
- This public, anonymous service accepts short-lived text. It does not accept files or authenticate the sender or recipient. Avoid payment card data, recovery codes, private signing keys, and regulated identity records.
- The browser encrypts text before upload; the random key is not sent to the API. The default separate-key option keeps it out of the URL. If you turn that option off, the key is carried in the URL fragment, so anyone who gets the URL can try to reveal the text.
- Reveal is a deliberate one-time request, but scanners or previews may still consume a share. A wrong key after consumption requires a new share.
- Each share expires after five minutes. Revoke when no longer needed; cleanup is scheduled, but expiry does not prove deletion from backups.
- The URL and API are publicly reachable and do not authenticate operators or recipients. Anyone may attempt to create shares; application quotas are not a hard spend cap.
A one-time link is not multi-factor authentication. Send the link and key separately, or use an approved password manager.