799 stars · Apache-2.0, read from /blob/master/LICENSE on 2026-09-27; standard text, no added conditions · v1.22.0 (2026-09-27), read from /releases/latest and confirmed by ungh · Track this in Scout
A one-time secret page: the text is encrypted in the browser with 256-bit AES and destroyed the first time it is read.
▶Repo detailsthe review · specs · pros & cons · install
What it is
ots stores a secret and hands back a link that works exactly once. The browser generates a key and encrypts the text with 256-bit AES before anything leaves the machine, and the key travels in the part of the link that browsers never send to the server.
What it is good for. Anybody who has ever pasted a password into a chat window or an email. Those messages are searchable and permanent, and they outlive the reason they were sent. The README puts the design plainly: "The password is never sent to the server so the server will never be able to decrypt the secrets it delivers with a reasonable effort." There is an API for creating a secret from a script, and a companion command-line tool, so it can be built into a process rather than only used by hand. At 799 stars it is the smallest project in this edition and has been maintained since August 2017 — nine years.
- The encryption happens in the browser, so a server that is stolen or seized gives up scrambled text and no keys.
- Nine years of unbroken maintenance, and version 1.22.0 was released on the morning this edition was written.
- One small program with no database needed to start, configured entirely by environment variables, under plain Apache-2.0 with no conditions.
- Two defaults are wrong for real use. Storage defaults to memory, which the documentation describes as "wiped on restart of the daemon", so every pending secret is lost when it restarts. And
SECRET_EXPIRYdefaults to0, which means no expiry at all, so unread secrets sit there forever. Durable operation means adding Redis, which is a second service to run and secure. - The documentation is split up and thin in places. The README says it moved to the wiki, and it contains no complete
docker runcommand at all — only the name of the image. - Building from source needs a very new toolchain: Go 1.25.7 or newer, and Node 22 or newer for front-end work. No memory or disk figures are given, and putting HTTPS in front of it is your job.
- onetimesecret/onetimesecret
2,947 stars, the original of this idea, running since 2013 and still taking code today; Ruby rather than one binary.
Track this in Scout - pglombardo/PasswordPusher
3,202 stars, adds full audit logs and view counts, so you can see who opened what and when; a larger thing to run.
Track this in Scout - jhaals/yopass
3,150 stars, the same browser-side encryption and it also handles files; the closest match of the three.
Track this in Scout
# container docker run -d -p 3000:3000 \ -e STORAGE_TYPE=redis \ -e REDIS_URL=redis://user:password@redis-host:6379/0 \ -e SECRET_EXPIRY=604800 \ ghcr.io/luzifer/ots:latest
