Secreta
Self-hosted, zero-knowledge one-time secret links — your server can't read what it stores.
The problem it solves
Every team shares secrets: a database password, a Stripe key, a server login. It ends up pasted into Slack, email, or a ticket — where it sits forever, searchable, in a dozen inboxes and backups. The quick share becomes a permanent liability.
Hosted one-time secret tools help, but most still put your plaintext on somebody else's server and ask you to trust them. For credentials, that trust is the whole problem.
What you get
Browser-side encryption
AES-256-GCM encryption happens in the browser with a key generated locally that never reaches the server.
Burn after reading
Destroy a secret after one view, or set a custom view limit.
Configurable expiry
Expire links anywhere from 1 hour to 30 days, or never.
Passphrase = genuine two-factor
With a passphrase set, the link alone is NOT enough: the data key is wrapped under PBKDF2-SHA-256 (150k iterations) of the link key plus the passphrase — an attacker needs both the link and the phrase.
Team accounts and audit log
Require sign-in to create secrets, then review who made and viewed what — metadata only, never contents.
Self-hosted, one-time purchase
Runs on PHP 8+ with MySQL or SQLite on standard shared hosting, with no subscription or per-secret fees.
Installable mobile app (PWA)
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Own It 2.0 — API, 2FA, backups, dark mode
Secreta 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
- One-click backups
- Dark mode
Own It 3.0 — works for your AI, not just for you
Sharing gets ceilings, not suggestions: the longest life any secret may have, the most views it may allow, optionally a passphrase above a view count — applied identically to the form, the REST API and the MCP endpoint, because all three mint through one function. A request for never-expires is clamped, not excused.
- Roles with email invitations and a last-admin guard
- Append-only audit trail across browser, API and agent
- Scheduled backups with a guided dry-run restore
- Optional single sign-on (OIDC)
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Screenshots
Honest limitations
- Text secrets only — no file sharing
- HTTPS is required in production (browser Web Crypto needs a secure context)
- One admin account at install; more team members are added directly in the database
- Opening a link spends a view even if a passphrase attempt is wrong (the server can't tell whether decryption succeeded — recipients are warned before revealing)
- A lost passphrase cannot be recovered
Two-minute web installer; PHP 8+ with pdo and openssl, MySQL or SQLite, standard shared-hosting compatible; HTTPS required in production.
Covered in these guides
Where your business data physically lives, who can be compelled to hand it over, and what "EU hosting" does and does not buy you. The questions to ask any SaaS vendor, and the case where self-hosting answers all of them at once.
Frequently asked questions
Is zero-knowledge just a marketing word here?
No — the random encryption key is generated in the browser and placed in the URL fragment after the #, which browsers never send in HTTP requests. The server receives only ciphertext and an IV, so it has no key to decrypt with.
What does the server actually store?
Ciphertext (encrypted a second time at rest), an IV, and metadata: expiry, view count, a passphrase-protected flag, and a salted one-way hash of the creator's IP. Never plaintext, never the key, never a passphrase.
Do I need HTTPS?
Yes — HTTPS is required in production because browser Web Crypto needs a secure context.
Can I share files instead of text?
No — Secreta shares text secrets such as passwords, keys, and notes; it does not share files.
Can a lost passphrase be recovered?
No — and that's the point. Once a secret is viewed or expired, it's destroyed, and the server never had the key. Create a new one.