devmatei/shh

shh is a small app for sharing a secret, like a password, exactly once. You paste some text in, you get a link back, and the first person who opens that link and clicks reveal sees the secret before it is permanently deleted. After that, the link shows the same not found page whether the secret was already viewed, expired, or never existed at all, so nobody can tell which of those happened. The project describes itself as zero knowledge, meaning your secret is encrypted inside your own browser before it is ever sent anywhere. The encryption key is placed in the part of the URL after the hash symbol, which browsers never send to a server, so only you and whoever you share the link with can ever decrypt the secret. The server only ever stores the encrypted text and a random id, with no accounts, no logging, and no analytics. When a secret is viewed, it is deleted in the same database operation that reads it, so two people trying to open the same link at once cannot both succeed. Secrets expire automatically after one hour, one day, or seven days, whichever comes first, and the server clears out expired secrets every minute. To prevent abuse, it caps itself at ten thousand stored secrets at a time, though this rarely matters since viewed or expired secrets free up space again. Technically, the app is built with plain Node.js and no external dependencies, using Node's built in SQLite support, along with a single plain HTML page with no build step. It can be self hosted with Docker in a couple of commands, or run directly with a recent version of Node. This project is aimed at developers and technical users who want a private way to share a password or other sensitive text once, without trusting a third party service they cannot inspect.