Share secrets.
Not exposure.
Encrypted in your browser. Stored as ciphertext. Destroyed on read.
The server is provably blind.
// How it works
Four layers. Zero trust.
// How it works
Four layers.
Zero trust.
You encrypt, locally
AES-256-GCM runs entirely in your browser using the Web Crypto API. The plaintext never leaves your device unencrypted.
{ name: "AES-GCM", iv }, key, data
)
Key stays in URL fragment
The decryption key is appended as a #fragment — which browsers never include in HTTP requests. The server receives zero key material.
Server stores only ciphertext
Redis holds { ciphertext, iv, ttl }. Nothing else. Even a full server breach leaks only encrypted bytes.
Burn on read
The moment the recipient decrypts, the Redis key is atomically deleted. The link is dead. No replay, no second access.
// CLI
Push and pull from anywhere.
No browser required. One command to share, one to receive. Built for CI pipelines, onboarding scripts, and developers who live in the terminal.
.env with npx secrettnl push// Features
Everything you need.
Nothing you don't.
Password Protection
Add a PBKDF2-derived second encryption layer. Even with the link, wrong password = no access.
Configurable TTL
Set expiry from 30s to 7d. Redis auto-deletes. 1h, 24h, 7d or raw seconds.
Webhook on View
Attach a webhook URL. Get an HTTP POST the moment your secret is accessed. Powered by QStash.
Versioned Secrets
Group secrets into named vaults with version history. Diff any two versions.
Audit Trail
View timestamp and viewer IP logged per access. Stored in Redis, separated from the secret.
GitHub OAuth
Sign in to manage your secret history, audit logs, and versioned vaults from the dashboard.
// Versioned Secrets
Track changes. Securely.
Manage configuration drift across your team.
Group secrets into named vaults. Every time you push a new version, a diff is computed and stored. Roll back instantly.
// Security Model