Question 1

Is it really free?

Accepted Answer

Yes. Every feature on this page is free, with no account and no card. Rate limits keep abuse in check, and that is the only restriction.

Question 2

What if I lose the link?

Accepted Answer

It is gone. We store only the encrypted blob, and the key lived in the part of the URL that never touched us. There is no reset, no recovery, no support ticket that can bring it back.

Question 3

Will Slack or Telegram burn my secret?

Accepted Answer

No. Those apps fetch links to build previews, which destroys secrets on most services. We only serve the content after a real click, so a preview bot leaves the secret intact.

Question 4

Can I let more than one person read it?

Accepted Answer

Set the view count up to ten when you create it. Each open consumes one view, and the secret disappears when the budget runs out.

Question 5

Why should I trust you?

Accepted Answer

You do not have to. The encryption runs in your browser, so you can open your own network inspector and see that only scrambled bytes ever leave your machine.

Question 6

Is there an API?

Accepted Answer

Yes, and it is free and keyless. Create secrets, check whether one is still alive without burning it, and reveal or delete it — all documented on the API page.

Question 7

Can I send a file?

Accepted Answer

Yes, up to 5 MB. Attach it with the paperclip in the composer and it is encrypted in your browser exactly like text, before it leaves your device. You can add a note alongside the file — both travel inside the same encrypted payload. One caveat: the file name, size, and type are stored unencrypted, because we need them to hand the file back. Keep secrets out of the file name.

Question 8

What does the password do if everything is already encrypted?

Accepted Answer

It is a second lock, not the encryption key. The secret is already encrypted with the key in the link, so the password guards against someone who obtained the link itself — a forwarded message, a shared screen, a synced clipboard. Send the link one way and the password another, and one interception is not enough. Wrong guesses never consume a view, so nobody can burn your secret by guessing.

Question 9

How do I know someone read it?

Accepted Answer

Turn on "Tell me when it is opened" and give us a webhook URL or an email address. The moment the secret is read we notify you with the id, the time, and your own label — never the content. If your endpoint is down we retry four times over roughly two minutes.

Question 10

How long can a link live?

Accepted Answer

From one minute to thirty days. The presets cover the common cases, and "Custom…" takes any value in between. When the time runs out the record is deleted automatically, whether or not anyone opened it — expiry and view count are independent limits, and whichever comes first wins.

Question 11

What does the recipient see before opening?

Accepted Answer

A warning that opening destroys the secret, and nothing else. The content is only fetched after they explicitly click reveal, so nobody burns a secret by accident just from following the link. If a password is set, they are asked for it first.

Question 12

Can I create secrets from the terminal?

Accepted Answer

Yes. Run npx openonce "my api key" --ttl 1h, or pipe anything into it. Encryption happens locally in the CLI, exactly as it does in the browser, so we never see the content. The link goes to stdout and status messages to stderr, which keeps pipes clean.

Question 13

Can a search engine find my link?

Accepted Answer

No. Links are never listed anywhere, ids are random, and secret pages tell crawlers not to index or cache them. We also send no-referrer, so if your secret contains a link, opening it does not leak your secret URL to the destination site.

Question 14

Is the Slack command as secure as the website?

Accepted Answer

No, and we would rather say so plainly. Slack sends your command text to our server as plaintext — that is how slash commands work — so we encrypt it server-side and hand the key back in the link, then forget it. The secret is still one-time and still expires, but unlike the browser flow, the plaintext did briefly exist on our side. For anything highly sensitive, use the website.

Questions people ask