shh 🤫

a tiny zero knowledge, one time secret sharing app. you paste a secret, you get a link, the link works exactly once, then the secret is gone forever. that's it, that's the whole app.

i built this because pasting passwords into chat apps that keep history forever is kinda cursed, and most "secure" sharing tools want an account or trust you can't verify. this one is small enough that you can read the entire thing in one coffee.

how the zero knowledge part works

the short version: your secret gets encrypted in your browser before anything is sent anywhere. i literally cannot read your secrets even if i wanted to.

the slightly longer version:

• your browser generates a random AES-256-GCM key and encrypts the secret with WebCrypto
• only the ciphertext goes to the server. the key gets put in the URL fragment (the part after the #), and fragments are never sent in http requests, that's just how browsers work
• the server stores ciphertext plus a random id, nothing else. no accounts, no analytics, no logging of ids or bodies
• on the first view, the server deletes the secret in the same atomic query that reads it, so two people racing to open the link can't both win
• expired secrets get swept server side every minute
• decryption happens back in the browser using the key from the fragment

if a secret is already viewed, expired, or never existed, you get the exact same "no longer exists" page for all three. the server can't tell you which one happened, and honestly neither can i.

one more nice touch: opening a link doesn't burn the secret immediately. you have to click reveal first, so link previews from slack or imessage won't eat your secret before your friend even sees it.

also, the server caps itself at 10k stored secrets at a time so nobody can spam it and fill your disk. viewed and expired secrets free up their slot, so in practice you'll never hit it.

self host it

you need docker, that's the entire list of requirements.

git clone https://github.com/DevMatei/ephemeral-text-share.git
cd ephemeral-text-share
docker compose up -d

open http://localhost:3000 and you're done. secrets persist in a docker volume so restarts don't nuke unopened links.

want a different port? set PORT:

PORT=8080 docker compose up -d

run it without docker

it's plain node with zero dependencies, the built in sqlite included. node 22.13 or newer:

node server.js

no npm install. there's nothing to install, lol.

expiry options

every secret dies on first view or when the timer runs out, whichever comes first:

• 1 hour
• 1 day
• 7 days

the stack

• node http server, no framework
• sqlite via node:sqlite, so zero npm dependencies
• one html page, plain css, plain js, no build step

small files, boring code, easy to audit. tbh that's a feature for something handling secrets.

made by devmatei