A safer way to hand someone a secret
ProtectedShare exists for one moment: you have a password, a key or a file someone else needs, and pasting it into chat feels wrong. You shouldn't need an account to do better.
Why it exists
Secrets get shared the easy way: a database password in a team chat, an API key in an email, a Wi-Fi password in a group text. Those messages stay in histories, backups and notification previews long after anyone needs them.
ProtectedShare makes the careful way about as quick. Your browser encrypts the secret, the server holds only ciphertext, and the link stops working after it's read or when it expires. Nobody signs up for anything.
What's in it
Every tool keeps plaintext in the browser.
- Secure noteEncrypted text behind a link. Can burn after one read.
- EnvShareSend .env files and API keys with a read limit.
- File dropEncrypted files up to 25 MB, with a download limit.
- Secret requestAsk someone for a secret, encrypted to you.
- ChatAn encrypted room, purged when everyone leaves.
- NotepadEncrypted notes in your browser, with optional sync.
- Claude connectorCreate secret links from Claude, over MCP.
- Password generatorPasswords and passphrases, generated locally.
- Secret key generatorRandom keys for .env files, JWTs, Django and Rails.
- Breached password checkerCheck a password against known breaches, privately.
Who it's for
People who need to get one secret to one person: a freelancer sending client credentials, a developer handing over a .env file, someone asking a colleague to send them a password without it landing in chat.
It isn't a password manager and it isn't a replacement for your team's messenger. It's the courier between them: small, temporary handoffs that should leave nothing readable behind.
How it keeps its promise
Encryption is AES-256-GCM in your browser, through the Web Crypto API. Keys ride in the part of the link after #, which browsers don't send to servers. The server stores ciphertext and a hash it can check before handing that ciphertext out, so it can enforce read limits without being able to read anything.
That isn't magic. Our host still sees IP addresses, and the server knows sizes, counts and times. The security model and privacy page spell out exactly what it can and can't see.
Open source
All of it, the web app, the API and the crypto package, is public on GitHub under the MIT license. Read it, file issues, or run your own copy. No independent audit has been published; the code being open is how you can check our claims today.
ProtectedShare is maintained by Kunal Siyag. The hosted tools are free and show no ads. If you need a dedicated instance or just want to say something, get in touch.