SecureShare: Zero-Knowledge Encrypted Sharing
AES-256-GCM encryption happens in your browser so our servers never see your secrets, API keys, or credentials in plaintext.
Create a Secure Share in Seconds
Paste your secret, choose an expiration, and get a shareable link. Encryption happens before anything leaves your browser.
Designed for Sensitive Data
Built by security professionals who know how credentials should actually be shared.
Client-Side Encryption
Content is encrypted with AES-256-GCM entirely in your browser using the Web Crypto API. The encryption key is placed in the URL hash fragment, which is never sent to the server.
Burn After Reading
Set shares to self-destruct after one view, or configure a custom view limit. Once the limit is reached, the encrypted content is permanently deleted from the database.
API Access
Create and retrieve secure shares programmatically via the REST API. Integrate secret sharing into CI/CD pipelines, onboarding scripts, or incident response workflows.
Recipients Click to Reveal
No account required. Recipients open the link, click Reveal, and the content is decrypted in their browser. One-time shares are permanently deleted after viewing.
The server cannot view this content without the key in this link.
Why Not Just Use Slack or Email?
Passwords and API keys sent over Slack persist in message history forever. Email is transmitted in plaintext between servers. Shared spreadsheets with credentials get indexed by search. Every one of these channels creates a permanent, searchable record of your most sensitive data.
SecureShare solves this with zero-knowledge encryption and automatic expiration. The secret exists only for as long as you need it, and the server never has the ability to decrypt it.
Common Use Cases
SecureShare fits naturally into security team workflows and DevOps processes.
Credential Handoffs
Share database passwords, SSH keys, or service account credentials with team members during onboarding or incident response. Set to burn-after-reading so the credential is not permanently stored anywhere.
CI/CD Secrets
Use the REST API to programmatically create shares for deployment tokens, signing keys, or environment variables. The recipient (human or script) fetches the secret once, and it is automatically destroyed.
Penetration Test Reports
Share sensitive pentest findings, discovered credentials, or proof-of-concept payloads with clients. Set a 7-day expiration and a view limit so the content does not persist after the engagement ends.
How It Works
Paste your secret
Enter the API key, password, or credential you need to share. No file uploads or attachments -- just plain text in the browser.
Encrypted in browser
AES-256-GCM encryption runs entirely in your browser via the Web Crypto API. The 256-bit key is generated locally and never transmitted to the server.
Share the link
Copy the shareable URL. The decryption key is embedded in the hash fragment (#...) which browsers never send to servers. Recipients do not need a MetricTower account.
Reveal and destroy
The recipient clicks Reveal to decrypt the content in their browser. If set to burn-after-reading, the encrypted blob is permanently deleted from the database after viewing.
Security-First Architecture
Every design decision prioritizes the confidentiality of your shared secrets.
Hash Fragment Key Storage
The decryption key is stored in the URL hash fragment (#...). Per the HTTP spec, browsers never transmit hash fragments to servers -- meaning the key exists only in the sender's and recipient's browser. Server logs, proxies, and CDNs never see it.
Configurable Expiration
Set shares to expire after 1 hour, 24 hours, 7 days, or 30 days. Combine with view limits -- 1 (burn after reading), 3, 5, 10, 25, or unlimited -- for fine-grained control over how long secrets remain accessible.
No Account Required for Recipients
Anyone with the link can view the shared content. No sign-up, no login, no friction. The sender creates the share from their Metric Tower account; the recipient just opens the link in any modern browser.
REST API for Automation
Create secure shares programmatically via POST /api/v1/secureshare with Sanctum authentication. Retrieve metadata and reveal content via public endpoints. Integrate secret sharing into deployment scripts, onboarding flows, or incident response playbooks.
Stop Sending Secrets in Plaintext
SecureShare encrypts content in your browser with AES-256-GCM before it ever reaches our servers. The decryption key lives only in the URL hash -- we cannot read your data. Zero-knowledge encryption, burn-after-reading, no account required for recipients, and configurable expiration -- built into Metric Tower.