Repolode
Submit
Luzifer

Luzifer/ots

A one-time secret sharing web app that encrypts secrets with AES-256 in the browser and deletes them on first read.

Open-source alternative to:OneTimeSecret

View on GitHubWebsite
Stars
809
Forks
99
Open issues
12
Last commit
yesterday

What is it?

OTS is a one-time secret sharing platform. A secret is encrypted with symmetric 256-bit AES in the browser before it is sent to the server, and the server stores only the ciphertext. The generated URL contains the secret ID and the decryption password, and the password is kept in the URL fragment so it is never sent to the server.

The secret is deleted immediately after its first read, so it can only be viewed once. The server can store secrets in memory or in Redis, and an optional expiry can be set in seconds.

Besides the web UI, a command-line client named ots-cli can create and fetch secrets from scripts, pipe content through STDIN, attach files, and authenticate against a custom instance with basic auth or custom headers.

Key features

  • 01Encrypts secrets with AES-256 in the browser before upload
  • 02The server never receives the plaintext secret or the password
  • 03Secrets are deleted on first read
  • 04Supports in-memory and Redis storage backends with optional expiry
  • 05ots-cli enables creating and fetching secrets from scripts

Use cases

  • Sending passwords or API keys to a colleague without leaving them in chat logs
  • Sharing one-off credentials that should expire after a single view
  • Automating secret handoff in CI or shell scripts with ots-cli
  • Self-hosting a private secret-sharing service for an internal team

Quick start

  1. 1

    Pull the Docker image from ghcr.io/luzifer/ots

  2. 2

    Start the server and open http://localhost:3000/

Things to know

  • The README lists only the in-memory and Redis storage backends, so persistent storage requires Redis.
  • Using the public ots.fyi instance means trusting its operator, so self-hosting or client-side encryption is advised for sensitive data.

In collections

Self-hosted appsPrivacy & local-first toolsSecurity scanners, audits & threat intel tools

Topics

#encryption#aes-256#secret-sharing#golang#self-hosted#security#redis#aes256#one-time-secret

FAQ

What is ots?
A one-time secret sharing web app that encrypts secrets with AES-256 in the browser and deletes them on first read. OTS is a one-time secret sharing platform. A secret is encrypted with symmetric 256-bit AES in the browser before it is sent to the server, and the server stores only the ciphertext. The generated URL contains the secret ID and the decryption password, and the password is kept in the URL fragment so it is never sent to the server.
Is ots free to use? What license does it have?
ots is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is ots still maintained?
Actively maintained. The last commit to ots was on Nov 6, 2026.
What can I use ots for?
Sending passwords or API keys to a colleague without leaving them in chat logs Sharing one-off credentials that should expire after a single view Automating secret handoff in CI or shell scripts with ots-cli Self-hosting a private secret-sharing service for an internal team
How do I install ots?
Pull the Docker image from ghcr.io/luzifer/ots Start the server and open http://localhost:3000/
Where can I get ots?
The source code and installation instructions are on GitHub: https://github.com/Luzifer/ots

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects