Skip to content
End-to-end encrypted · No account needed

Share secrets.
Leave no trace.

Send passwords, API keys and private notes through an encrypted link that opens once and then disappears — from the chat, the inbox and our servers.

Templates
Encrypted in your browser0 chars · 0 B / 16 KiB

No account needed. The key never reaches our servers.

How it works

Three steps. Zero copies left behind.

  1. secret.env
    DB_PASS=hunter2-prod-429fQ2xL0eTz8aMw4KrB7vN1c
    AES-256-GCM · 256-bit key sealed
    Step 01

    Encrypt in your browser

    Your secret is sealed with AES-256-GCM before it leaves this page, using a fresh random key.

    • AES-256-GCM
    • HKDF
    • Client-side
  2. vaultdrop.example/s/Xk2p…#M3f9…
    Browser
    id
    Server

    #key stays in the browser — never sent

    Step 02

    Share one link

    The key rides in the link after “#”, a part browsers never send to servers. Add a passphrase for a second factor.

    • URL fragment
    • 128-bit id
    • Argon2id
  3. one-time secret1 view0 views
    Destroyed
    Step 03

    Read once, then gone

    The recipient opens it, it decrypts on their device, and the ciphertext is deleted from our database in the same step.

    • Row-locked
    • Atomic delete
    • Single view
Read the full walkthrough

Use cases

For developers, teams and everyone in between

Onboarding credentials

Hand a new teammate their first password without it living in chat history forever.

API keys & tokens

Send a production key to a contractor that self-destructs the moment it's read.

CI/CD & scripts

Pipe a generated credential into vaultdrop from the terminal and post the link to a ticket.

Personal sharing

Wi-Fi passwords, door codes, recovery codes — share them with family without a trace.

Support & IT

Reset a password for a customer and deliver it over a channel that forgets.

Automated workflows

Get a signed webhook when a secret is opened, so your system can rotate or revoke access.

Security

Built so that we can't read your secrets

Zero-knowledge by construction: the server only ever handles ciphertext and a verifier that cannot decrypt anything.

What we store
Ciphertext, expiry, view count, a size bucket, and a one-way verifier.
What we never receive
Your plaintext, the link key, or your passphrase.
One-time, for real
A row lock plus conditional update guarantees one successful redemption, even under concurrent requests.
No third parties
No analytics, ads or external scripts. A strict Content Security Policy enforces it.
Security architecture
Live · encrypted in this browser
You type
DATABASE_URL=postgres://admin:S3cr3t@db.internal/prod
AES-256-GCM
VaultDrop stores
············································

Real ciphertext, sealed with a fresh 256-bit key each time. The key never leaves the page.

POST /api/v1/secretsJSON
// Everything the server ever receives
{
  "envelope": {
    "v": 1,
    "iv": "q3Z1x9Rk2jVb0mNs",
    "ct": "8fJk2Lq0vN…Yw"     // AES-256-GCM
  },
  "kdf": {
    "alg": "argon2id", "salt": "Vb0mQ1…",
    "t": 2, "m": 19456, "p": 1
  },
  "verifier": "M0wJr4…",     // can't decrypt
  "expiresIn": 86400
}

Developers

An API that keeps the zero-knowledge promise

Encrypt locally with our CLI or SDK examples, create links over a versioned REST API, and receive signed webhooks when secrets are opened.

  • Versioned REST API with OpenAPI 3.1 spec
  • Hashed-at-rest API keys with scopes and separate live/test environments
  • Idempotency keys for safe retries
  • HMAC-signed webhooks with replay protection and retries
Read the docsAPI reference
~/projects/api — zshShell
echo "$DB_PASSWORD" | vaultdrop --expires 1h
# → https://vaultdrop.example/s/b2Zm…#Jx8…

vaultdrop --passphrase --views 3 < recovery-codes.txt
# Passphrase: ••••••••
# → https://vaultdrop.example/s/7Hq1…#mP2…

Pricing

Free for everyday sharing. Plans for teams and automation.

Free

Everything you need to share safely.

$0forever

  • Unlimited one-time secrets (rate limited)
  • Expiry up to 7 days
  • Passphrase protection
  • Client-side AES-256-GCM encryption
  • Revoke links before they are read
Create free account

Personal

More room for everyday sharing.

$4per month

  • Everything in Free
  • Expiry up to 30 days
  • Multi-view links (up to 5 views)
  • 64 KiB secrets
  • Read notifications
Choose Personal

Pro

Popular with developers

For developers and automation.

$12per month

  • Everything in Personal
  • REST API, CLI and SDK access
  • Signed webhooks
  • 256 KiB secrets, up to 10 views
  • Separate live and test credentials
Choose Pro

Team

Shared workspaces with central control.

$9per seat / month

  • Everything in Pro
  • Organizations and invitations
  • Role-based access control
  • Metadata-only audit log
  • Custom branding on share pages
Choose Team
Compare all plans

FAQ

Questions, answered plainly