ProtectedShare vs OneTimeSecret
OneTimeSecret made one-time links mainstream, and both projects are open source. The main difference is where encryption happens: ProtectedShare does it in your browser, before anything is uploaded.
Feature comparison
| Feature | OneTimeSecret | ProtectedShare |
|---|---|---|
| Encrypts in your browser before upload | ||
| Encrypts in your browser before upload | No | Yes |
| Deletes after the first view | ||
| Deletes after the first view | Yes | Yes |
| Expires after a set time | ||
| Expires after a set time | Yes | Yes |
| Allow a set number of reads | ||
| Allow a set number of reads | No | Yes |
| Passphrase | ||
| Passphrase | Yes | Yes |
| Encrypted file sharing | ||
| Encrypted file sharing | No | Yes |
| Ask someone to send you a secret | ||
| Ask someone to send you a secret | Not stated | Yes |
| Open source | ||
| Open source | Yes | Yes |
| Self-hostable | ||
| Self-hostable | Yes | Yes |
| Works without an account | ||
| Works without an account | Yes | Yes |
Encryption before upload, not after
OneTimeSecret's docs describe secrets being encrypted on their servers. That protects data at rest, but the server handles the readable secret on the way in.
ProtectedShare encrypts in the browser with AES-256-GCM. The key travels in the link after #k= or as a password you send separately, so the server only ever has ciphertext and a hash it can check. A database leak gives away no secrets.
More than one-time links
Secret delivery is rarely the whole job. EnvShare allows 1 to 100 reads for credentials someone needs during setup. File drop handles encrypted files up to 25 MB. Secret request lets someone send you a password encrypted to a key only you hold. Chat and an encrypted notepad sit alongside.
Try it on ProtectedShare
Free, with no account. Each tool encrypts in your browser before anything is uploaded. The security model lists exactly what the server stores.
- Secure NotesA note encrypted in your browser. Burns after one read by default; add a password to send separately.
- EnvShare.env files, API keys and passwords, deleted after 1 to 100 reads or at expiry.
- File dropFiles up to 25 MB, encrypted in your browser and deleted after 1 to 100 downloads.
- Secret requestSend someone a link. What they type back is encrypted to a key only your browser holds.
Questions
What makes ProtectedShare a good OneTimeSecret alternative?
Both send links that expire. ProtectedShare encrypts in your browser before upload, so the server stores ciphertext rather than encrypting what it receives. It also offers 1 to 100 reads, expiry up to 30 days, encrypted file drops, secret requests, an encrypted notepad and chat, with no account.
Is ProtectedShare really free?
Yes. The hosted tools are free with no signup, and the whole project is MIT licensed, so you can self-host it on Cloudflare Workers with the Docker web image. Limits apply: shares expire within 30 days and file drops are capped at 25 MB.
Can the server read my one-time secret?
No. Your browser encrypts it with AES-256-GCM before upload. The key stays in the link after # (which browsers don't send to servers) or in a password you send separately. The server receives ciphertext and a hash it uses to check access, never the key or the plaintext.