Frequently asked questions
Short, honest answers about how OncePad shares a secret — and what it deliberately can't do
Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.
How does OncePad work?
Your browser encrypts the secret with AES-256-GCM under a generated 7-word passphrase (the key is derived with PBKDF2-HMAC-SHA256, 600,000 iterations) and uploads only the ciphertext. The recipient opens the link, enters the passphrase, and the secret is decrypted in their browser and deleted from the server in the same moment.
Can OncePad read my secret?
No. Encryption happens in your browser and the key is derived from the passphrase, which is never sent to us — the link carries no key at all. The server stores an opaque blob it cannot decrypt, so there is nothing for us, or anyone who breached us, to read.
Why do I get a link and a passphrase?
Two channels. The link carries no key, so it is safe to paste in email, Slack, or a ticket; the passphrase travels separately — a text, a call, said out loud. Someone who sees only one of them has nothing.
What happens after the secret is opened?
It is destroyed on the first reveal — burn after reading, exactly once. If it is never opened it expires after 24 hours. Secrets live only in RAM, never on disk, and a restart wipes them all.
Do I need an account? Are there cookies or trackers?
No accounts, no cookies, no ad pixels, no third-party analytics, and no remote JavaScript. One anonymous in-memory counter records visits carrying the exact utm_source=chatgpt.com tag without keeping a URL, IP, referrer, user agent, or timestamp. The only browser preference is light/dark theme.
What can I share, and how big can it be?
Passwords, API keys, tokens, .env blocks, private keys, one-time codes — any short text up to about 64 KB. You can also send a file (up to 25 MB), encrypted in your browser the same way, with its name hidden inside the encryption. Either way it is built for handing something to a person once, not for storage: it is deleted as soon as it is opened.
Can I unsend a secret?
Yes. The screen that shows your link also has an "Erase it now" button, which revokes the secret before anyone opens it.
Will a link preview in Slack or iMessage open my secret?
No. Opening the link only shows a page that asks for the passphrase; the secret is destroyed only when the recipient reveals it. Preview bots and prefetchers cannot burn it.
How is this different from pasting a password into chat?
A chat message sits in a searchable history, on servers you don't control, for as long as the account exists. A OncePad link holds nothing readable, works once, and expires on its own — and the passphrase never travels with it.
What if the recipient types the passphrase wrong?
Nothing is lost. The encrypted secret is fetched once and decrypted in their browser, so a wrong or misordered phrase just fails locally and they can try again on the same page. What they must not do is reload after a successful reveal — the page then holds the only copy.
What if I lose the passphrase?
The secret is unrecoverable — by you, the recipient, or us. The key exists only as a derivation of the passphrase, and we never see either. Erase the secret and create a new one.
Can I choose my own passphrase or change the expiry?
The passphrase is generated for you (7 words from a 1,296-word list, about 72 bits) because human-chosen phrases are far weaker. You can add your own words on top, or redraw the set; removing generated words is allowed but warned, and at least seven words are always required. Expiry is fixed at 24 hours or the first read, whichever comes first.
Can anyone tell whether a link was already opened?
Only that it no longer works. An opened, expired, erased, or never-existent link all show the same "not found" page — deliberately, so the page reveals nothing about whether a secret ever existed.
Do you log IP addresses?
IP addresses are used transiently for rate limiting and abuse control and are never linked to a secret. Request logging is switched off in production because the request path contains the secret's id. See the terms for the full privacy statement.
Is it free? Is there a catch?
It is free to use, with no accounts, plans, ads, or trackers. Rate limits keep it available for everyone; the acceptable-use rules are in the terms.
Want the design in depth? Read how OncePad keeps a secret — the encryption model, the two-channel design, and the threat model.