Secrets

Share passwords, keys and sensitive data securely

With colleagues, customers or suppliers, through a link that stops working once it has been opened.

  • Free
  • No account needed
Create secretHow it works

Paste it here. Send the link. Done.

No sign-up needed to create a secret or to receive one.

Two ways to send credentials
over chat, email or a support ticket

In plain text

  • It stays written forever
  • Anyone who joins can see it
  • It ends up in backups, screenshots and forwards
  • You don't know who has read it
  • It never expires

With a secret

  • Only a link is left there
  • It can be revealed as many times as there are people who need it
  • It travels end-to-end encrypted: no one can read it on the way, not even us
  • You know whether it has been opened
  • It expires on its own after the time you choose

How it works

  1. Create a secret
    and set when it expires

    • Password
    • API key
    • Token
    • Certificate

  2. Send the link
    however you like

  3. The recipient reveals it
    and keeps it somewhere safe

    • Password manager
    • CI/CD variables
    • Secrets store
    • The app that asks for it

What if the wrong person opens it?

  1. You notice

    The recipient can no longer open it

    Needs an accountYou see it in the panel

  2. Change the password
    wherever it is used

  3. Create a new secret
    with the new password

  4. Send it
    over a safer channel

Frequently asked questions

What can I share with a secret?

Text and files up to 2 GB: passwords, API keys, tokens, certificates or any other credential.

How is the content protected?

When you create the secret, your browser encrypts it with AES-256-GCM, the standard banks and password managers use, before it leaves your computer.

Only the encrypted content reaches our servers: the key to decrypt it stays in the link we give you.

When the recipient opens the link, their browser downloads the encrypted content and decrypts it right there with that key.

On the way and on our servers there is only encrypted text.

Who can read it?

Anyone who has the link, as long as the secret has not expired or run out of reveals.

Can anyone at Nebux read it?

No. The key is only in the link, and the link never goes through our servers. Without the key, what we store is unreadable, to us too.

What do I gain by sending it this way?

A secret does not stop someone reading it if the link falls into the wrong hands, but it puts you in control:

  • It leaves no copies in the chat or the email.
  • It disappears once revealed or when it expires.
  • If the wrong person opens it, you find out and can change the password before they use it.
Do I need an account?

No. You can create secrets without signing up. With an account, you see them all in the dashboard and know when they were revealed.

How long does a secret last?

As long as you choose: 1 hour, 6 hours, 24 hours or 7 days. After that it expires, even if no one opened it, and its content is deleted from our servers.

How many times can it be revealed?

Between 1 and 100: as many as there are people who need it. Once the limit is reached, the content is deleted from our servers and it cannot be opened again.

What does someone who opens the link too late see?

That the secret is no longer available, with nothing of what it held.

Can I send the link over a channel that is not secure?

Yes, but anyone who sees it could open it. The difference is that, if it happens, you will know. And if the person you sent it to reveals it first and the limit was a single reveal, no one else can get it afterwards.

How do I know if the wrong person opened it?
  • With an account, you see in the dashboard how many times it was revealed and when.
  • With or without one, if your recipient goes to open it and is told it was already revealed, someone got there first.
Does it replace a password manager?

No. A secret is for getting a credential to someone, not for keeping it. Whoever receives it should store it somewhere safe: a password manager, the CI/CD variables or the application that needs it.

What do I do if the wrong person revealed it?

Treat the credential as compromised:

  1. Change it wherever it is used.
  2. Create a new secret with the new credential.
  3. Send it over a safer channel.

Send the next password this way

Create secretDo it with an account

Free · No account needed