About zeepass
zeepass is a free tool for sending a password, an API key or a .env file to someone as a link that works once. Your browser encrypts the text with AES-GCM-256 before it leaves your device, and the key stays in the part of the link that browsers never send to a server.
Encrypted in your browser
A random 256-bit key is made on your device and the text is encrypted there. Only the encrypted text is sent to the server.
The key stays in the link
The key sits after the # in the link. Browsers do not send that part to a server, so the server stores data it cannot decrypt.
Gone after one read
With burn after first read on (the default), the stored copy is deleted the moment the recipient reveals it. Opening the link alone, or a chat app’s link preview, does not reveal it. Otherwise it is deleted when it expires: after 1 hour, 24 hours or 7 days.
No account needed
Paste, encrypt, copy the link. There is nothing to sign up for, and the person you send it to only needs a browser.
Frequently asked questions
How do I share a password securely?
Paste the password, API key or .env file into the box, choose how long the link should last and press Encrypt & Generate Link. Send the link to the person who needs it. When they open it and press reveal, the text is decrypted in their browser, and by default the stored copy is deleted at that moment.
Is my secret stored on your server?
Only in encrypted form. The server keeps the encrypted text, its initialization vector and a one-way hash of the key (used to check the key before the text is released), in storage pinned to the EU, until the secret is opened or expires. It never receives the plaintext or the key. This browser also remembers the links you created, in local storage on your device, so you can find them again in the sidebar. You can remove them there.
Can anyone else read it, including the server?
Not without the full link. The key is in the part of the link after the #, which browsers do not send to servers, so the server holds data it cannot decrypt. Anyone who has the full link can read the secret, so send it only to the person it is meant for and keep burn after first read on.
Is it free, and do I need an account?
It is free and needs no account or sign-up. A secret can be up to 256 KB. Requests are rate limited per visitor to prevent abuse.
Does it work on my phone?
Yes. It runs in any modern browser that supports the Web Crypto API, on phones, tablets and desktops. The person who receives the link only needs a browser.
Is it open source?
Yes. The code is MIT licensed and published on GitHub: https://github.com/wzee1/zeetools/tree/main/apps/zeepass