Once
Stop sending passwords on WhatsApp.
A small, working web app for sharing passwords and private notes: the content is encrypted in the browser, the link opens once or expires after a set time, and even the server can’t read what it stores.
- Services
- Cybersecurity
- Web development
- System design
- Technology
- Next.js
- TypeScript
- Web Crypto API
Writing a secret, with a timer, an optional password and a request to be told when it’s opened
1 / 8The challenge
Passwords, ID photos and contracts get sent over WhatsApp and email, and stay in those chats for years. Many sharing tools still ask people to trust a server that can read what it stores, and chat link previews can open a link before the recipient does.
The approach
Once encrypts each secret in the browser with AES-256-GCM and puts the key in the part of the link after the #, which browsers never send to the server. An optional password adds a second key derived with PBKDF2. The server stores only unreadable data, releases it a single time and deletes it in the same step, and the recipient must press Reveal, so link previews can’t use it up. The project is open source, covered by 46 automated tests, and comes with an honest threat model.
Designed around
- Encryption in the browser with AES-256-GCM
- The key travels only in the link, never to the server
- An optional password, with PBKDF2 at 600,000 iterations
- Opens once, or expires after a set time
- Safe from chat link previews
- A private status link to see when it was opened
- Open source, with tests and a plain-language threat model
