About OncePad
Who operates the service, who is responsible for it, and how to verify its claims
Operator and responsibility
OncePad is operated and maintained by My Tiny Rocket LLC, a company organized in Wyoming, USA. The operator is responsible for the hosted service, its security controls, product documentation, and incident response. General and privacy questions go to support@oncepad.com; vulnerability reports go to security@oncepad.com.
What the product is for
OncePad is a free, no-account service for handing a password, secret, or file to another person once. Encryption and decryption happen in the browser, the link carries no key, and the generated passphrase travels separately. It is a short-lived handoff mechanism, not a password manager, permanent file store, identity provider, or replacement for endpoint security.
Evidence, not trust slogans
The public threat model states what the design does and does not protect. The exact encryption format and test vectors let reviewers reproduce compatibility checks. Product changes are dated in the changelog, and security reports are governed by the public disclosure policy.
Audit and incident status
OncePad has not yet completed an independent third-party security audit. No security incident has been publicly disclosed as of August 18, 2026. If either fact changes, the report, remediation, or incident summary will be linked from the security page and recorded in the changelog.