One-Time Secrets

How it works

1. Your browser makes a random 256-bit key and encrypts the secret with AES-256-GCM.
2. Only the ciphertext is sent. The key goes after the # in the link, and browsers never send that part to a server.
3. The server keeps the ciphertext in Redis until it's read once or expires, whichever comes first.
4. Opening the link only checks it. Revealing fetches the ciphertext, deletes it, and decrypts it here.

Still a demo: there's no SLA, so don't trust it with production credentials. For that, self-host something like Yopass.

From a script

curl -s https://api.syntaqx.com/secrets \
  -H 'Content-Type: application/json' \
  -d '{"secret":"hunter2","ttl":600}'

References

• GitHub Actions & Secret Inputs
• API reference: /secrets
• MDN: AES-GCM in the Web Crypto API