How to share a private key securely
SSH keys, certificates, connection strings, service-account JSON, and .env files
Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.
First ask whether the private key should move
The safest private key is often one that is generated on the destination and never exported. For SSH access, prefer adding the recipient's public key; for cloud access, prefer short-lived roles or workload identity. Share a private key only when the system genuinely requires the same key material on another endpoint.
If transfer is necessary
- Use the text mode for a PEM block, connection string, or small JSON document; use file mode for a key bundle, certificate archive, or
.envfile up to 25 MB. - Send the key-less link through the work channel and the generated passphrase through a separate channel.
- Have the recipient store it with restrictive filesystem permissions or import it directly into the destination vault.
- Confirm receipt, then rotate or retire the transferred key as soon as the operational need permits.
Preserve the exact bytes
Text mode preserves line breaks, quotes, and delimiters for SSH/PGP keys, PEM certificates, database URLs, and service-account JSON. File mode seals the original filename inside the encrypted manifest. OncePad never parses or validates the key, so the sender must verify that the correct material was selected.