Share a secret. Once.
Passwords and keys do not belong in chat or email. Send them as a link that works exactly one time, or ask someone to send you one. Your browser encrypts it, our server only ever sees ciphertext.
Run it yourself with your own login provider. Recipients never need an account.
Secrets travel through the least safe places.
A password sent in chat stays in the chat history, in the mailbox, in backups and in every search index, usually for years. Most leaks are not hacks, they are old messages.
Chat or email
- How long it staysFor years, searchable
- Who can read itEveryone with access to the mailbox, workspace or backups
- If it gets forwardedIt spreads and you never know
- What the provider seesPlain text on their servers
- If someone else opened itYou do not find out
- Cleaning upManual, usually forgotten
- How long it staysDeleted after the first view
- Who can read itOnly whoever opens the link first
- If it gets forwardedA copy is useless, the link works once
- What the provider seesCiphertext, never the key
- If someone else opened itThe link is used up, so you know
- Cleaning upAutomatic, including expiry
Three steps. The person who receives it needs no account.
Encryption happens in your browser. The server never sees anything readable, and after the first open it is all gone.
- Step 1
Encrypt in the browser
Your browser creates a random key and encrypts the text with AES-256-GCM before anything leaves your device.
You write your secret into the form and choose how long it lives, from one minute to seven days. If you like, you set a password. Everything this needs happens in your browser. Only afterwards does anything reach the server, and that is just the encrypted text.
- A new, random key for every secret
- Encrypted with AES-256-GCM, right in the browser
- Lifetime from one minute to seven days
- Step 2
Share the link
The server stores only the ciphertext. The key is appended to the link after a #, and browsers never send that part to a server.
You get a link made of three parts: the address, the ID of the secret and, after the #, the key. You send the link through any channel, for example chat, email or a ticket. The server only sees the address and the ID, never the part after the #.
- The server only knows address and ID
- The key sits behind the #
- Browsers never send that part
- Step 3
Open once, then gone
The first reveal returns the ciphertext and deletes it in the same step. The recipient's browser decrypts it with the key from the link.
Whoever opens the link needs no account. On the first visit the browser fetches the ciphertext, the server deletes it in the same step, and the browser decrypts it locally. If someone opens the link again, nothing is left. If it is never opened, the server deletes the secret when it expires.
- The recipient needs no account
- Deleted on first view
- Otherwise deleted at expiry
The key lives behind the #.
A web address has parts. Everything up to the # is sent to the server when you open the link. Everything after the # stays in your browser by design. ExoSeal puts the key there, so the server can store the secret but can never read it.
seal.example.comServerWhere the request goes./s/3f9c1e7a-4b2d-4c8eSecret IDFinds the ciphertext. Random and unguessable.#Zk4q9XvT2mLw0Pz3KeyStays in the browser. Never transmitted.
Where ExoSeal really helps.
Everywhere a password would otherwise end up in a chat.
ExoSeal fits anything that only one person should read and that should not exist afterwards: logins, API keys, recovery codes, contract details. Pick a case and see how it plays out.
Access for a freelancer
Send the server login once, without it living in your project chat forever.
- YouPaste the login, pick a lifetime, optionally set a password.
- LinkSend the link by chat, the password separately.
- Other sideOpens it once and copies the login. After that it is deleted.
Two ways to share a secret.
Send a secret you have, or ask for one you need.
Send
You have a secret and someone needs it. Paste it, pick a lifetime, optionally add a password, and share the link.
Sign in and sendRequest
Someone has a secret you need. Send them a request link: they answer in the browser, you open the reply with your passphrase.
Sign in and requestWhat the server really sees.
Nothing in readable form. Here is the full list.
All of this can be read in the source code. ExoSeal is open source under AGPL-3.0, and you can run it on your own server, so only you see what is stored there.
sees
Ciphertext. Your secret or reply, unreadable without the key.
Your question. In plain text, because the recipient has to read it.
Name and email. Only with requests you create, to show your name and notify you.
Who sends and when. Your provider ID plus time, lifetime and status of every sent link, so you see it under "Sent". It never knows the recipient.
never sees
The key. It lives in the part of the link after the # and in your passphrase.
Your IP address. The application never stores or logs it. Rate limiting uses a keyed hash that expires within a minute.
What notifications say. Mail and webhook only say that a reply arrived, never what it says.
Who opens your link. The server never knows who receives or opens a link.
What we cannot promise you.
Honest limits, because trust needs them. No tool protects against everything, so we tell you upfront where ExoSeal ends.
A compromised server
A hacked server could serve modified code. That is why ExoSeal is open source and self-hostable. For very high stakes use a native tool like age or GPG.
A leaked full link
Whoever gets the whole link before the recipient opens it first. You will see that it is used up.
A weak passphrase
For requests, the wrapped private key is stored encrypted. A short passphrase could be guessed offline if the database leaked. Use a long sentence.
A lost passphrase
There is no recovery. The reply is gone.
Verifiable, not just promised.
We do not ask you to take our word for it. The code is open, the encryption runs in your browser, and you can check every claim on this page yourself.
Questions we hear often.
Short, honest answers about security, usage and operation. You will find more on the FAQ page.
01Can ExoSeal read my secrets?
No. They are encrypted in your browser with a key that stays in the part of the link after the #. Browsers never send that part to a server.
02What if someone else opens the link first?
Then it is gone for the intended recipient, and they see that the link was used up. Treat the secret as compromised, change it and send a new one. Under "Sent" you see whether and when a link was opened.
03Why do I have to sign in to send?
So strangers cannot use this server as a free relay. Recipients and people answering a request never need an account.
04Do you track visitors?
No cookies for visitors, no analytics, no external resources, and our application stores and logs no IP addresses.
05How long does a secret live?
You choose one hour, one day or seven days. The secret is deleted on first view, on expiry or when you withdraw the link, whichever comes first.
06Can I run it myself?
Yes. ExoSeal is open source under AGPL-3.0 and runs with one docker compose file and your own login provider.
Ready to share your first secret?
ExoSeal is open source under AGPL-3.0. Run it yourself with one docker compose file and your own login provider.