Password generator

Your secret is encrypted in your browser (AES-256-GCM) before it is sent. The server only receives ciphertext.

The key is in the link after the #. Browsers never send that part to a server, so we can't read your secret.

The server encrypts that ciphertext once more before storing it, and Redis deletes it when it expires.

One-time secrets are deleted as part of the read; nothing is fetched until the recipient clicks "Reveal".

There is no list or search endpoint, invalid IDs return 404, and requests are rate limited.

Create a secret