v1.0.0

1time v1.0.0

One-time links for passwords, API keys and files, encrypted in the browser. This release makes self-hosting a first-class edition and brings bigger files and more reliable opens on phones.

Self-hosting

• Self-hosted edition by default. The Docker images now ship only the tool: text and file sharing, the password generator and My Secrets. No blog, no marketing pages, no analytics, nothing loaded from other hosts.
• No hostname to configure. Links are built from the address people open the instance at.
• Rate limits per visitor behind your proxy. nginx trusts the forwarded visitor IP only from the container's own Docker network, which covers a proxy on the host or in the same compose file. New settings: TRUSTED_PROXIES, REAL_IP_HEADER, RATE_LIMIT, RATE_LIMIT_WRITE, RATE_LIMIT_UPLOAD, RATE_LIMIT_READ.
• Production security headers (CSP, X-Frame-Options, Referrer-Policy) in the container. HSTS is left to your TLS proxy.
• Guide: https://1time.io/self-hosted/

Sharing

• Files up to 250 MB, uploaded in 4 MiB pieces.
• Lower memory use in the browser for large files.
• Downloaded files stay on the page after saving.
• On phones, the last view of a text secret survives a reload or reopen for 10 minutes. It's kept on that device only, and only the ciphertext, never the key.
• A confirmation before saving program files (exe, msi, apk…).

Security

• The secret and file pages send no referrer at all.

Upgrading

• APP_HOSTNAME and SHOW_BLOG are no longer used; remove them from .env.
• If your reverse proxy runs on another machine, set TRUSTED_PROXIES to its address. Never use a whole private range like 10.0.0.0/8.
• To build the full 1time.io site from source instead, use SELF_HOSTED=false.