Frequently Asked Questions

You enter your sensitive information into the form on the home page. We encrypt it with AES-256 and store it in our database. We give you a unique one-time URL. You share that URL with your recipient. When they open it, the secret is decrypted, displayed once, and then permanently deleted from our servers.

Yes. The URL itself contains only a random identifier (GUID) and reveals nothing about the secret. Even if someone intercepts the URL, they can only use it once — and if the intended recipient opens it first, the attacker sees nothing. If you are concerned, choose a short expiry time.

No. Once the secret is revealed it is immediately and permanently deleted from the database. Not even our administrators can recover it. If you need to share it again, create a new secret.

The secret will automatically expire after the time period you selected (between 1 hour and 7 days). An hourly background job purges all expired secrets from the database.

Any plain text up to 10,000 characters — passwords, API keys, private notes, connection strings, PINs, etc. Do not upload binary files or highly regulated personal data (e.g. social security numbers, full credit card numbers).

Yes. All secrets are encrypted with AES-256-CBC using a unique IV per secret before being stored in the database. The encryption key is held in the application configuration (Azure Key Vault in production) and is never stored alongside the data.