Secreta

Self-hosted one-time secret links, encrypted in the browser. The key stays in the link and never reaches your server, so the server stores only ciphertext.

The problem it solves

Every team shares secrets: a database password, a Stripe key, a server login. It ends up pasted into Slack, email, or a ticket — where it sits forever, searchable, in a dozen inboxes and backups. The quick share becomes a permanent liability.

With a hosted tool you rely on the vendor's server. With Secreta, the server is yours and it holds only ciphertext. For credentials, that trust is the whole problem.

Every feature

• Team accounts managed in the app. Invite, deactivate and reactivate members from the Team page — with two refusals that cannot be waived: you cannot deactivate yourself, and you cannot deactivate the last active admin. Deactivation stops sign-in and touches no secret they created.
• Change your own password. Current password proven, 8+ characters, same-password reuse refused — and the route takes no user id at all, so no path exists to change anyone else's. The audit row records that it changed, never the value.
• Browser-side encryption. AES-256-GCM encryption happens in the browser with a key generated locally that never reaches the server.
• Burn after reading. Destroy a secret after one view, or set a custom view limit.
• Configurable expiry. Expire links after 1 hour, 6 hours, 1 day, 3 days, 7 days or 30 days, or never, unless your sharing policy sets a shorter ceiling.
• Passphrase: the link alone is not enough. With a passphrase set, the link alone is NOT enough: the data key is wrapped under PBKDF2-SHA-256 (150k iterations) of the link key plus the passphrase — an attacker needs both the link and the phrase.
• Team accounts and audit log. Require sign-in to create secrets, then review who made and viewed what — metadata only, never contents.
• Self-hosted, one-time purchase. Runs on PHP 8.1+ with MySQL or SQLite on standard shared hosting, with no subscription or per-secret fees.
• Installable mobile app (PWA). Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is not stored offline on the device; what you see is read live.
• Hand it across a desk. Show any new link as a QR code, drawn in your browser; the code carries the whole link, key included.
• Ask for a secret, not just send one. Send a client a request link; what they type is encrypted in their browser to a key only you hold, and you open it once. They need no account, and the server stores nothing it can read.
• Send a file, not just a password. A certificate, a key file or an .env goes with the secret, encrypted in your browser with the same key; photos lose their location data first. Off until you switch it on.
• Share from the terminal. One file, secreta-send, encrypts on your own machine and prints the link.
• One link per person. Send the same secret to several people and each gets their own link with its own key, so you can see whose has been opened. Names stay your note: the person opening a link never sees them.
• Updates from inside the app. The Updates page installs a new release with your license key: Ownware's signature is checked, a backup is taken first, and the app puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. It never checks by itself.
• Backups by themselves. Automatic backups, an optional copy to S3-compatible storage you own, and a weekly check that the latest backup reads back. The Health page names anything that needs attention.
• Own It 4.0.1 — fixes and an up-to-date manual. For Secreta, 4.0.1 fixes an installer that had lost its styling, a rollback that a page opened during an update could stop and a command-line update that ended in an error after putting the previous version back. Its manual, FAQ and QUICKSTART now cover everything 4.0 added, including two Nginx rules that keep the data folder private. Your license covers it: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0.2 — the installer opens on every host. For Secreta, 4.0.2 fixes a fresh install on an Apache host: the one-page setup at /install/ looped back to itself and never opened, and now it opens. Your license covers it: press Check for updates on the Updates page, or download it from your order page.

Release notes in full

• Own It 4.1: client installations and your other tools. For Secreta, 4.1 makes two changes that every app gets. An Extended license bought from October 4, 2026 covers up to ten client installations, one per client project: hand each one over to the client or host it for them, with the client's logo and colors from the app's branding settings. The API reference now shows how to connect Secreta to Zapier, Make or n8n, using its own webhooks and API key. Your license covers the update: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0: it updates and backs itself up. For Secreta, 4.0 means updates from inside the app: the Updates page checks for a new release with your license key, verifies Ownware's signature, takes a backup and puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. A new install can start with a sample business and remove it in one click; backups run by themselves, with an optional offsite copy and a weekly check that the latest one reads back; and the Health page says whether the install is looking after itself.
• Own It 3.3: one link per person. 3.3 lets the same secret go to several people, each with their own link and its own key, so you can see whose has been opened. The names stay your note: the person opening a link never sees them.
• Own It 3.2: secrets that travel both ways. 3.2 let secrets travel both ways: send a client a request link, and what they type is encrypted in their browser to a key only you hold. It also brought a file with the secret (off until you switch it on), sharing from the terminal with secreta-send, and templates for the requests you send again and again.
• Own It 3.1: team management in the app. Secreta 3.1 moved team management into the app: invite, deactivate and reactivate members, with yourself and the last admin protected, plus a change-password route that cannot reach anyone else's account. It still sends no email: invitations are one-time links you hand over.
• Own It 3.0: works for your AI, not just for you. Sharing gets ceilings, not suggestions: the longest life any secret may have, the most views it may allow, optionally a passphrase above a view count — applied identically to the form, the REST API and the MCP endpoint, because all three mint through one function. A request for never-expires is clamped, not excused.
• Own It 2.0: API, 2FA, backups, dark mode. The owner layer every Ownware app carries. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.