Passwords, recovery codes and access details often travel by chat or email, and stay there long after they were needed. One-time Secret gives such a message one delivery and a fixed end.

The One-time Secret page at aisense.no, with its first step: a field for the message to share.

Encrypted before it leaves the browser

The page generates a new 256-bit key for every message and encrypts the text with AES-256-GCM before anything is sent. The service receives the encrypted message only. The key travels in the link after #, the fragment, which browsers do not send to any server. The page loads no analytics, third-party scripts or remote fonts, keeps nothing in browser storage, and removes the link details from the address bar as soon as it has read them.

One click, one delivery

Opening the link shows a Reveal button and nothing else, so a link preview or a scanner that fetches the page uses nothing up. The click releases the encrypted message once, the browser decrypts it, and the link stops working. The service records the delivery before it answers, so a connection that drops at that moment can lose the message. The page says so, and it never retries on its own. What the recipient sees, they can copy or keep.

A receipt for the sender

Creating a message gives two links. The secret link goes to the recipient. The receipt link stays with the sender: it shows whether the message is pending, delivered, revoked or expired, and it can revoke a message that has not been opened. It cannot read the message. Delivered means the service released the encrypted message once. It does not prove who opened it, or that anyone read it.

Twenty-four hours

Every message expires 24 hours after it is created, and activity does not extend that. Delivery, revocation or expiry ends access, and the encrypted record and its receipt are removed at the next cleanup. A message holds up to 16 KiB of text, and each IP address can create 100 messages per UTC day.

For scripts and agents

The same service has a REST API at https://aisenseapi.com/services/v1/secret and four tools on the free MCP server. Both take the encrypted message only. A client encrypts and decrypts on its own side, sends the read and receipt tokens in the Authorization header, and never passes the text, the key or a complete secret link to an MCP tool or an AI conversation, where they may be kept.

POST /services/v1/secret                       create, with the encrypted envelope
POST /services/v1/secret/{secret_id}/reveal    the one delivery, with the read token
GET  /services/v1/secret/{secret_id}/receipt   the state, with the receipt token
POST /services/v1/secret/{secret_id}/burn      revoke, with the receipt token

The One-time Secret API guide gives the envelope format, the answers and the errors. On the free MCP server the tools are create_one_time_secret, reveal_one_time_secret, read_one_time_secret_receipt and burn_one_time_secret.

Try it

Open One-time Secret, write a message, and send the secret link through a channel you trust. Keep the receipt link for yourself.