Skip to main content
Send encrypted text secrets and files that can only be viewed once. Every secret is encrypted with OpenPGP on your device before it reaches the server — the decryption key never leaves your browser. After the recipient opens the link, the ciphertext is permanently deleted.

​
How It Works

  1. Compose your secret — Enter text (a password, API key, config snippet) or select a file
  2. Client-side encryption — The browser generates a random passphrase and encrypts the content with OpenPGP symmetric encryption
  3. Server stores ciphertext — Only the encrypted payload is sent to the server, which stores it in Redis with an expiration timer
  4. Share the link — The generated URL contains the secret identifier in the path and the decryption key in the URL fragment (#), which browsers never transmit to the server
  5. One-time reveal — When the recipient clicks “Reveal Secret”, the server returns the ciphertext and atomically deletes it. The browser decrypts using the key from the fragment
The decryption key lives exclusively in the URL fragment. It is never included in HTTP requests, server logs, or analytics. The server only ever stores and returns OpenPGP ciphertext.

​
Use Cases

  • Passwords and credentials — Share login details with a colleague without leaving a trace in Slack or email history
  • API keys and tokens — Distribute secrets to developers or CI systems without committing them to a repository
  • Sensitive documents — Share contracts, tax forms, or private notes that should not persist anywhere
  • Incident response — Relay compromised credentials to security teams over a channel that guarantees single use

​
Key Features

​
Zero-Knowledge Encryption

Secrets are encrypted using OpenPGP symmetric encryption entirely in the browser. The server receives and stores only the armored ciphertext. There is no key escrow — if the link is lost, the secret is unrecoverable.

​
One-Time Read

Every secret is deleted from storage the moment it is retrieved. The server uses an atomic GETDEL operation in Redis to ensure the ciphertext cannot be read twice, even under concurrent requests.

​
Automatic Expiration

Secrets that are never retrieved are automatically purged after their expiration window. The expiration is configurable between 1 minute and 7 days (default: 1 hour). Redis TTLs handle cleanup with no background jobs required.

​
Text and File Support

Both plain-text secrets and encrypted files are supported through separate endpoints. Files follow the same encryption and one-time-read model as text secrets.

​
No Account Required

Secret sharing is fully anonymous. Neither the sender nor the recipient needs to create an account or authenticate.

​
API Endpoints

All endpoints are served under the /api/file-sharing prefix.

​
Create a Text Secret

​
message
string
required
OpenPGP-encrypted (armored) secret message. Maximum 1 MB.
​
expiration
integer
default:3600
Time-to-live in seconds. Minimum 60 (1 minute), maximum 604800 (7 days).
POST /api/file-sharing/secret
Content-Type: application/json

{
  "message": "-----BEGIN PGP MESSAGE----- ...",
  "expiration": 3600
}
Response (201 Created): 
{
  "message": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
The message field in the response is the secret’s UUID identifier, not the encrypted content. Use this identifier to construct the share link.

​
Fetch a Text Secret

GET /api/file-sharing/secret/{secret_id}
Response (200 OK): 
{
  "message": "-----BEGIN PGP MESSAGE----- ..."
}
Returns the encrypted ciphertext and permanently deletes the secret from storage. A second request to the same URL returns 404.

​
Create a File Secret

POST /api/file-sharing/file
Content-Type: application/json

{
  "message": "-----BEGIN PGP MESSAGE----- ...",
  "expiration": 3600
}
The request and response format is identical to text secrets. The encrypted file content is sent as an armored OpenPGP message in the message field.

​
Fetch a File Secret

GET /api/file-sharing/file/{file_id}
Behaves identically to the text secret fetch endpoint — returns the ciphertext and deletes it atomically.

​
Security Properties

PropertyImplementation
Encryption algorithmOpenPGP symmetric encryption (AES-256) via the openpgp library
Key managementRandom passphrase generated client-side, embedded in URL fragment only
Zero knowledgeServer stores and returns only armored ciphertext; decryption key never reaches the server
Atomic deletionRedis GETDEL ensures ciphertext is read at most once, even under race conditions
Automatic expiryRedis TTL purges unclaimed secrets after the configured expiration window
Rate limiting30 creates per 10 minutes and 60 fetches per minute per IP address
Payload limit1 MB maximum for encrypted payloads, enforced server-side
No persistenceSecrets live only in Redis (in-memory); nothing is written to disk or a database
The share link follows this structure: 
https://rapidly.tech/secret/{secret_id}#{decryption_key}
  • {secret_id} — UUID identifying the stored ciphertext, sent to the server
  • #{decryption_key} — OpenPGP passphrase in the URL fragment, never sent to the server
When the recipient opens this link, the frontend extracts the key from the fragment, fetches the ciphertext from the API, and decrypts it locally.