How OneTimeSecret Works: Encryption, Zero-Knowledge, and Self-Destruction

A technical deep dive into OneTimeSecret's AES-256 encryption, zero-knowledge architecture, password protection, and expiration controls.

The Technology Behind OneTimeSecret

OneTimeSecret combines several cryptographic techniques to keep your secrets safe: client-side AES-256 encryption, a zero-knowledge architecture where the server never sees your plaintext, and automatic data destruction after a single view. The project is open-source, so every component can be independently audited.

This approach differentiates OneTimeSecret from closed-source tools like Privnote, and aligns it with other open-source alternatives such as Password Pusher, Yopass, and PrivateBin. Below is a step-by-step breakdown of how each piece works together.

Step-by-Step: How OneTimeSecret Creates a Self-Destructing Link

1

Private Message Creation

You enter your secret private message into the onetimesecret platform. This could be a password, API key, confidential note, or any sensitive information you need to share securely.

At this stage, your private message exists only in your browser's memory.
2

Client-Side Encryption

Before any data leaves your device, your one time secret message is encrypted using AES-256 encryption (Advanced Encryption Standard with 256-bit keys). This is the same encryption standard used by governments and military organizations worldwide to protect private messages.

AES-256 would take billions of years to crack using brute force with current technology.
3

Key Generation & URL Fragment

A unique decryption key for your one time secret is randomly generated in your browser. This key is placed in the URL fragment (the part after the # symbol). Crucially, URL fragments are never sent to servers by browsers—this is part of the HTTP specification.

https://onetimesecret.info/secret/abc123#decryption-key-here

The portion after # containing your decryption key never reaches the server

4

Secure Server Storage

Only the encrypted ciphertext of your one time secret is sent to and stored on the server. Without the decryption key (which remains in the URL), this data is completely meaningless—just random characters.

Zero-Knowledge: The onetimesecret server never has access to your original private message or the key to decrypt it.
5

One Time Secret Link Sharing

You share the complete onetimesecret URL (including the fragment with the key) with your intended recipient. This can be done via any communication channel—email, SMS, chat, or in person.

For maximum security, share the one time secret link through a different channel than your usual communication.
6

Decryption & Destruction

When the recipient opens the one time secret link, their browser extracts the key from the URL fragment, requests the encrypted data from the server, and decrypts the private message locally. Simultaneously, the onetimesecret server permanently deletes the encrypted data.

The private message can never be viewed again—it no longer exists anywhere.

OneTimeSecret's Zero-Knowledge Architecture

Zero-knowledge means the OneTimeSecret server facilitates encrypted sharing without ever having access to the plaintext content. This is the same principle used by Password Pusher, Bitwarden Send, and Yopass, but OneTimeSecret's open-source code lets you verify the implementation yourself:

Sender

Encrypts private message in browser, receives full onetimesecret URL with key

Encrypted data only

One Time Secret Server

Stores encrypted blob, never sees key or private message plaintext

Encrypted data only

Recipient

Gets key from onetimesecret URL, decrypts private message locally

Additional OneTimeSecret Security Features

Password Protection

Add a passphrase that the recipient must enter before decryption. This creates a second encryption layer — a feature OneTimeSecret offers that Privnote does not.

Time-Based Expiration

Set a specific timeframe after which the onetimesecret will self-destruct, even if never viewed. Options typically range from 1 hour to 30 days.

View Notifications

Some one time secret services offer optional email notifications when your secret has been viewed, providing confirmation of private message receipt.

Open-Source Transparency

OneTimeSecret's code is fully open-source. Unlike closed-source tools like Privnote or scrt.link, anyone can audit the encryption implementation and verify the zero-knowledge claims.

Technical Specifications

Encryption Algorithm AES-256 (Advanced Encryption Standard)
Key Length 256 bits (2^256 possible combinations)
Encryption Location Client-side (in browser)
Key Storage URL fragment only (never on server)
Transport Security TLS 1.3 (HTTPS)
Data Retention Deleted immediately after first view
Previous: What is One Time Secret Next: Use Cases