Share API keys, tokens and .env files securely
Keep secrets out of Slack history, tickets, and git — hand them over once, encrypted
Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.
Where API keys leak
Rarely from the vault. They leak from the places they were handed over: a Slack DM that stays searchable for years, a Jira comment, an email to a contractor, a .env file attached to a ticket, a paste site, a commit that was "just for testing". Every one of those copies outlives its purpose, and one is enough.
Send a key with a one-time encrypted link
- Paste the key — or the whole
.envblock, up to about 64 KB — at oncepad.com. It is encrypted in your browser (AES-256-GCM under a generated 7-word passphrase) before upload; the server only ever holds ciphertext. - Post the link in the ticket, the DM, the onboarding doc. It carries no key, so the history holds nothing usable.
- Send the passphrase on a second channel — a text, a call, a different app.
- The recipient reveals it once, pastes it into their vault or environment, and it is gone from the server — or expires unopened after 24 hours.
Whole .env files, private keys, connection strings
Multi-line secrets survive intact — line breaks, quotes and = signs are preserved exactly, and the reveal shows them in a monospace block with a one-click copy. Anything that fits in ~64 KB of text works: .env and .envrc blocks, SSH and PGP private keys, database URLs, service-account JSON, OAuth client secrets, TOTP seeds, one-time recovery codes.
Rotate anyway
A one-time link fixes the hand-off; it does not undo copies that already exist. If a key was ever pasted in chat, rotate it and share the new one properly. Prefer short-lived, scoped credentials where the provider offers them, and store the long-lived original in a secrets manager — the link is for getting it there.
Onboarding, CI, and support hand-offs
Typical uses: bootstrapping a new engineer's local .env, passing a deploy token to whoever configures CI, sending a client their API credentials, or giving a support engineer a temporary access token. In each case the recipient needs only a browser — no account, no plugin — and you get an Erase it now button in case you sent it to the wrong person.