Repolode
Submit
AndrewPaglusch

AndrewPaglusch/FlashPaper

A self-hosted, one-time encrypted web app for sharing passwords and secrets without a database setup.

View on GitHub
Stars
525
Forks
73
Open issues
11
Last commit
16 days ago

What is it?

FlashPaper lets you paste a password or secret, encrypt it in the browser's server-side request flow, and get back a one-time link. The secret is deleted from storage once it is retrieved, so the recipient can read it only once.

Encryption uses AES-256-CBC, with per-secret keys and IVs, plus an additional static server key. Retrieval keys are verified with bcrypt, which prevents URL tampering. The app stores data in a local SQLite file and needs no separate database server.

It runs on Docker or on a traditional PHP 7.0+ web server, and it can be submitted through a simple curl API that returns the link as JSON. Settings cover auto-pruning of unretrieved secrets, custom base URLs for reverse proxies, and branding with a logo and title.

Key features

  • 01Encrypts each secret with AES-256-CBC and a unique key and IV.
  • 02Deletes a secret from the database after it is retrieved once.
  • 03Verifies retrieval keys with bcrypt to detect URL tampering.
  • 04Stores data in SQLite, so no separate database server is needed.
  • 05Offers a curl-friendly API that returns the one-time URL as JSON.
  • 06Auto-prunes unread secrets within a configurable day range.

Use cases

  • Sending a password to a colleague without leaving it in chat or email history.
  • Running a private, self-hosted secret-sharing service for a team or organization.
  • Sharing credentials from scripts or CI jobs through the curl API.

Quick start

  1. 1

    Download docker-compose.yml from the repo

  2. 2

    Edit docker-compose.yml with your customizations

  3. 3

    Start FlashPaper

    docker-compose up -d

Things to know

  • You must set up your own reverse proxy to terminate SSL/TLS.
  • Self-hosting is required, so you need a server or Docker and some setup.

In collections

Self-hosted appsPrivacy & local-first tools

Topics

#secret-sharing#encryption#one-time-secret#zero-knowledge#php#self-hosted#aes-256#aes#bcrypt#ciphertext

FAQ

What is FlashPaper?
A self-hosted, one-time encrypted web app for sharing passwords and secrets without a database setup. FlashPaper lets you paste a password or secret, encrypt it in the browser's server-side request flow, and get back a one-time link. The secret is deleted from storage once it is retrieved, so the recipient can read it only once.
Is FlashPaper free to use? What license does it have?
FlashPaper is open source under the MIT license. Check the license terms before using it in commercial products.
Is FlashPaper still maintained?
Actively maintained. The last commit to FlashPaper was on Oct 22, 2026.
What can I use FlashPaper for?
Sending a password to a colleague without leaving it in chat or email history. Running a private, self-hosted secret-sharing service for a team or organization. Sharing credentials from scripts or CI jobs through the curl API.
How do I install FlashPaper?
Download docker-compose.yml from the repo Edit docker-compose.yml with your customizations Start FlashPaper: docker-compose up -d
Where can I get FlashPaper?
The source code and installation instructions are on GitHub: https://github.com/AndrewPaglusch/FlashPaper

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects