Repolode
Submit
algolia

algolia/sup3rS3cretMes5age

A self-hosted service for sharing one-time secret messages and files that delete themselves after being read, backed by HashiCorp Vault.

Open-source alternative to:OneTimeSecret

View on GitHub
Stars
571
Forks
83
Open issues
7
Last commit
5 days ago

What is it?

sup3rS3cretMes5age is a web service for sending sensitive text or files through a link that works only once. The sender posts a message, receives a token-based URL, and the recipient opens it to read the content. After the first retrieval, the message and its token are permanently deleted. Messages can also expire on their own, with a default lifetime of 48 hours and a maximum of 7 days.

The service stores secrets in Vault's cubbyhole backend, using Vault tokens that allow exactly two uses: one to create and one to retrieve. It accepts file uploads up to 50MB, provides a simple HTTP API and a health endpoint, and includes shell functions for Bash, Zsh and Fish to send messages from the command line. Deployment options include Docker Compose, a Helm chart for Kubernetes, and multi-platform images for amd64 and arm64, with TLS through Let's Encrypt or manually supplied certificates.

The frontend is plain JavaScript with its assets self-hosted, so it makes no external CDN requests. It requires a running Vault server, and the README recommends production use only behind HTTPS and with a non-dev Vault instance.

Key features

  • 01Messages are deleted after the first read, and a configurable TTL limits how long they exist.
  • 02Files up to 50MB can be shared alongside text messages.
  • 03Secrets are stored in Vault's cubbyhole backend with two-use tokens.
  • 04Built-in TLS via Let's Encrypt, manual certificates, and HTTP-to-HTTPS redirection.
  • 05Docker images for amd64 and arm64, plus a Helm chart for Kubernetes.
  • 06Command-line shell functions for Bash, Zsh and Fish.

Use cases

  • Sharing a database password or API key with a colleague without leaving it in chat history.
  • Sending a one-off credential or certificate file to a contractor.
  • Running an internal self-destructing message service on your own infrastructure.

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/algolia/sup3rS3cretMes5age.git
  2. 2

    Enter the project directory

    cd sup3rS3cretMes5age
  3. 3

    Start the services with Docker Compose

    make run
  4. 4

    Open the app in your browser at localhost:8082

Things to know

  • Requires Docker or Go and HashiCorp Vault to run.
  • The quick start uses a Vault dev server with in-memory storage, which is not for production.
  • Production use requires running behind TLS and a separate production Vault server.

In collections

Self-hosted appsPrivacy & local-first toolsSecurity scanners, audits & threat intel tools

Topics

#secrets#vault#self-hosted#encryption#golang#kubernetes#one-time-secret#hashicorp-vault#security

FAQ

What is sup3rS3cretMes5age?
A self-hosted service for sharing one-time secret messages and files that delete themselves after being read, backed by HashiCorp Vault. sup3rS3cretMes5age is a web service for sending sensitive text or files through a link that works only once. The sender posts a message, receives a token-based URL, and the recipient opens it to read the content. After the first retrieval, the message and its token are permanently deleted. Messages can also expire on their own, with a default lifetime of 48 hours and a maximum of 7 days.
Is sup3rS3cretMes5age free to use? What license does it have?
sup3rS3cretMes5age is open source under the MIT license. Check the license terms before using it in commercial products.
Is sup3rS3cretMes5age still maintained?
Actively maintained. The last commit to sup3rS3cretMes5age was on Nov 2, 2026.
What can I use sup3rS3cretMes5age for?
Sharing a database password or API key with a colleague without leaving it in chat history. Sending a one-off credential or certificate file to a contractor. Running an internal self-destructing message service on your own infrastructure.
How do I install sup3rS3cretMes5age?
Clone the repository: git clone https://github.com/algolia/sup3rS3cretMes5age.git Enter the project directory: cd sup3rS3cretMes5age Start the services with Docker Compose: make run Open the app in your browser at localhost:8082
Where can I get sup3rS3cretMes5age?
The source code and installation instructions are on GitHub: https://github.com/algolia/sup3rS3cretMes5age

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects