1time.io — One Time Links for Passwords & Secrets

Pitch

Description

Comments

About this project

1time.io is a zero-knowledge encrypted secret sharing tool that lets you send passwords, API keys, and sensitive text through one-time links that self-destruct after being read.

1time.io performs encryption entirely in your browser - the server never sees your plaintext, and the decryption key exists only in the URL fragment, which browsers never transmit. No signup, no cookies, no tracking.

1time.io is a secure solution for one-time secret sharing that uses zero-knowledge encryption. This enables users to share sensitive data such as passwords, API keys, and confidential text via self-destructing links, ensuring that the information remains encrypted and inaccessible to unauthorized parties.

Key Features

🔐 Zero-Knowledge Encryption: Secrets are encrypted in the browser using AES-GCM, meaning the server never has access to plaintext data.
🔥 Self-Destructing Links: Once a link is used, it becomes invalid, ensuring that data is permanently deleted after one-time use.
🏠 Self-Hosted Option: Users can quickly deploy their own instance with Docker Compose in under two minutes, fostering privacy and control.
👤 No Signup Required: Sharing secrets is streamlined and efficient—simply paste a secret, obtain a link, and share it.
🔑 Built-In Generators: Provides tools to create passwords, passphrases, API keys, and WiFi passwords directly within the platform.
💻 First-Party CLI: The CLI tool allows for integration into various workflows, enabling secrets to be transmitted from the terminal, ideal for DevOps environments.
⚡ Lightweight Stack: Built using Go with a Redis backend and a static Next.js frontend, it optimizes resource usage without sacrificing performance.

How It Works

The process of sharing a secret is straightforward:

You                          Server                        Recipient
 │                             │                              │
 │  1. Type secret             │                              │
 │  2. Browser encrypts        │                              │
 │     with AES-GCM            │                              │
 │  3. Send encrypted blob ──► │  Stores encrypted blob       │
 │  4. Get link with key       │  (cannot decrypt it)         │
 │     in URL fragment (#)     │                              │
 │                             │                              │
 │  5. Share link ─────────────┼──────────────────────────►   │
 │                             │                              │
 │                             │  ◄── 6. Fetch encrypted blob │
 │                             │  7. Delete blob permanently  │
 │                             │  8. Send blob ──────────►    │
 │                             │                              │
 │                             │     9. Browser decrypts      │
 │                             │        with key from #       │

The encryption key remains in the URL fragment, ensuring it is never transmitted to the server. Even with complete database access, secrets cannot be accessed by the server.

Quick Start

Try the hosted version at 1time.io for a hassle-free experience without the need for signup, or integrate the CLI tool into your workflows using:

npm install -g @1time/cli

# To send a secret
printf 'postgres://user:pass@host/db' | 1time send

# To read a secret
1time read 'https://1time.io/v/#...'

Conclusion

1time.io is designed for users who prioritize security and simplicity in sharing sensitive information. With its robust encryption, no signup requirement, and self-destructing links, it provides a reliable platform for confidential communication.