One-time secret links
A one-time secret link shows its contents exactly once. You paste a password, an API key or a short note, YAFL encrypts it in your browser, and you get a link to send to one person. The first time that link is opened and revealed, the secret is shown and the link is used up. Anyone who opens it after that gets nothing.
How it works
- Paste the secret into the field at yafl.dev/secret and create the link. You need a free account to create one. The recipient needs nothing.
- Your browser encrypts the text with AES-256-GCM before anything is uploaded. The key is generated on your device and placed in the part of the link after the
#, which browsers never send to a server. - Send the link through whatever channel you like: chat, email, a ticket.
- The recipient opens the link and clicks Reveal secret. Their browser decrypts it and shows it with a copy button. The link stops working at that moment, and the encrypted copy is deleted from storage shortly after.
What the server can and cannot see
| Visible to YAFL? | |
|---|---|
| The secret itself | No. Only ciphertext is ever stored. |
| The decryption key | No. It lives only in the link's #fragment. |
| That a transfer is a secret, its size, and when it was created | Yes. The server uses the "secret" flag only to pick the retention window. |
| Who created it | Yes, the account that sent it. |
The full threat model, including what this does not protect against, is on the security page.
Why a link preview cannot burn it
Chat apps and mail clients fetch links to build previews. If a secret were destroyed the moment its page loaded, those previews would destroy it before the recipient ever saw it. YAFL only uses up a secret when a person clicks Reveal secret, so a preview can load the page without spending the link.
Good for
- Passwords and recovery codes
- API keys and tokens
- A
.envsnippet or a short config block - A Wi-Fi password for a guest
- Credentials for a new teammate's first day
For anything larger than text, such as a file, a folder or a database dump, send a regular encrypted file link instead, and tick "Delete after first download" if it should only work once.
Limits
- One read. The first reveal uses up the link. There is no "view again".
- 30 days. A secret nobody opens is deleted after 30 days.
- Up to 100,000 characters. Enough for keys, notes and config, not for whole logs.
- Optional password. Add one and the link alone is not enough. The recipient also needs the password, which you send separately.
FAQ
Can YAFL read my secret? No. The secret is encrypted in your browser before upload, and the decryption key is only ever in the link's #fragment, which is never sent to the server. YAFL stores ciphertext it cannot decrypt.
What happens if someone else opens the link first? They see the secret and the link is used up, so the intended recipient is told it has already been opened. That tells you the link was intercepted, and you should change the password or key.
How long does a one-time secret last? Until it is revealed once, or 30 days if nobody opens it. Either way it is then deleted and cannot be recovered.
Does the recipient need an account? No. Only the sender needs a free account. The recipient just opens the link in any browser.
Will a Slack or email link preview use up my secret? No. Previews can load the page, but the link is only used up when a person clicks Reveal secret.
Can I protect a secret with a password as well? Yes. Add a password when you create it, and the recipient needs both the link and the password. Send the password through a different channel than the link.