One Time Secret review 2026: share passwords and secrets via self-destructing links. Features, free vs Identity Plus pricing, pros, cons and alternatives.
One Time Secret has been running since 2011 as a simple, focused tool for sharing sensitive text, such as passwords or API keys, via a link that self-destructs after a single view. It started as a small hobby project and has grown into a sustainable small business with paid plans, custom domains and multi-region hosting.
The service is open source, with its full codebase published on GitHub, so security-conscious teams can either use the hosted onetimesecret.com service or self-host their own instance via Docker for complete control over their data.
Every secret is encrypted with its own unique key before storage and is permanently deleted from all storage the moment it is viewed once, so a link can never be reopened by anyone, including the original sender. Expiration can be configured from minutes up to 14 days on the free plan or 30 days on the paid plan.
The service supports custom domains for branded secret-sharing links, a REST API for programmatic integration into internal tools, and, on the paid tier, custom branding and unlimited team member invitations.
One Time Secret offers a fully functional free Basic plan, including one custom domain, expiration up to 14 days and REST API access, at no cost.
The paid Identity Plus plan costs 35 euros per month and adds unlimited custom domains, custom branding, expiration up to 30 days and unlimited member invitations; discounted rates are available for students and non-profits on request.
One Time Secret is used to share sensitive text like passwords, API keys and credentials via a link that self-destructs after being viewed once, so the information never sits permanently in email or chat history.
Yes, the Basic plan is free and includes one custom domain, expiration up to 14 days, and REST API access; a paid Identity Plus plan at 35 euros per month adds unlimited domains and custom branding.
Once a secret link is opened, it is permanently deleted from all storage and can never be viewed again, even by the original sender.
Yes, the full codebase is open source and published on GitHub.
Yes, because it is open source, technically capable users can self-host their own instance, typically via Docker, instead of using the hosted onetimesecret.com service.
Not fully. Each secret is encrypted with its own unique key before being stored, but encryption happens server-side, meaning the operator's server briefly handles the plaintext rather than using fully zero-knowledge client-side encryption.
Expiration is configurable up to 14 days on the free Basic plan and up to 30 days on the paid Identity Plus plan.