# zeepass

> Share passwords, API keys and .env files as one-time links, encrypted in your browser with AES-GCM-256. Free, open source, no sign-up.

## What it does

zeepass is a free tool for sending a password, an API key or a .env file to someone as a link that works once. Your browser encrypts the text with AES-GCM-256 before it leaves your device, and the key stays in the part of the link that browsers never send to a server.

## How it works

- Encrypted in your browser: A random 256-bit key is made on your device and the text is encrypted there. Only the encrypted text is sent to the server.
- The key stays in the link: The key sits after the # in the link. Browsers do not send that part to a server, so the server stores data it cannot decrypt.
- Gone after one read: With burn after first read on (the default), the stored copy is deleted the moment the recipient reveals it. Opening the link alone, or a chat app’s link preview, does not reveal it. Otherwise it is deleted when it expires: after 1 hour, 24 hours or 7 days.
- No account needed: Paste, encrypt, copy the link. There is nothing to sign up for, and the person you send it to only needs a browser.

## Privacy and data

- The text is encrypted in the browser with AES-GCM-256. The server never receives the plaintext or the key.
- The key is in the URL fragment (after #) of the share link, which browsers do not send to servers.
- The server stores the ciphertext, its initialization vector and a one-way hash of the key, in EU-pinned storage, until the secret is opened (burn after first read, on by default) or expires.
- This browser keeps a list of the links you created in local storage on your device; you can remove them from the sidebar.
- Anyone with the full link can read the secret.

## Limits

- Up to 256 KB per secret.
- Expiry is 1 hour, 24 hours (default) or 7 days.
- Requests are rate limited per visitor.
- Needs a modern browser with the Web Crypto API.

## FAQ

Q: How do I share a password securely?
A: Paste the password, API key or .env file into the box, choose how long the link should last and press Encrypt & Generate Link. Send the link to the person who needs it. When they open it and press reveal, the text is decrypted in their browser, and by default the stored copy is deleted at that moment.

Q: Is my secret stored on your server?
A: Only in encrypted form. The server keeps the encrypted text, its initialization vector and a one-way hash of the key (used to check the key before the text is released), in storage pinned to the EU, until the secret is opened or expires. It never receives the plaintext or the key. This browser also remembers the links you created, in local storage on your device, so you can find them again in the sidebar. You can remove them there.

Q: Can anyone else read it, including the server?
A: Not without the full link. The key is in the part of the link after the #, which browsers do not send to servers, so the server holds data it cannot decrypt. Anyone who has the full link can read the secret, so send it only to the person it is meant for and keep burn after first read on.

Q: Is it free, and do I need an account?
A: It is free and needs no account or sign-up. A secret can be up to 256 KB. Requests are rate limited per visitor to prevent abuse.

Q: Does it work on my phone?
A: Yes. It runs in any modern browser that supports the Web Crypto API, on phones, tablets and desktops. The person who receives the link only needs a browser.

Q: Is it open source?
A: Yes. The code is MIT licensed and published on GitHub: https://github.com/wzee1/zeetools/tree/main/apps/zeepass

## Links

- [zeepass](https://pass.wzee.dev): the tool
- [FAQ](https://pass.wzee.dev/faq): about zeepass and the questions people ask
- [Source code](https://github.com/wzee1/zeetools/tree/main/apps/zeepass): open source on GitHub
- [Privacy notice](https://wzee.dev/privacy): the privacy policy for all wzee.dev tools
- [Zoltán Farkas, wzee.dev](https://wzee.dev): the author
- [zeeimage](https://image.wzee.dev/llms.txt): resize, convert and compress images in bulk in the browser
- [zeecall](https://call.wzee.dev/llms.txt): peer-to-peer video calls, screen sharing and file transfer without an account