One-time secret

Password, API key, access code: delivered exactly once, encrypted in your browser.

Key facts

• AES-256-GCM encryption in the browser; the 32-byte key only exists in the link fragment #s:<id>/<key>.
• The server only stores the ciphertext and the SHA-256 hash of a token derived from the key: it cannot read the secret.
• Read once by default (deleted when read) or readable until expiry.
• Expiry from 1 minute to 7 days (24 h by default); up to 64 KiB of text.
• Optional password (PBKDF2-SHA256, 310,000 iterations); a wrong password does not destroy the secret.
• Link previews (messengers, bots) do not consume the secret: the recipient has to click “Show the secret”.

Good to know

• Anyone who gets the full link before the recipient can read the secret: send the optional password through another channel.

How to

1. Open https://filenymous.eu/app/#secret-new.
2. Type the secret, pick read-once or an expiry, and a password if needed.
3. Copy the link and send it to the recipient.

All features

• Direct file transfer
• Dropzone (receive files)
• Sharewall (ephemeral live wall for humans and AI agents)
• Streamed sharing (video and audio)
• Whistleblowing channel
• npm CLI “filenymous” (CI/CD)
• Browser extension (Chrome, Firefox)

Updated 2026-10-19