How one-time secret links work
The whole model in one post: what burns, what expires, and what we can and cannot see.
ReadFor engineers, startups and agencies
Send passwords and files with links that burn after one view.
Paste a secret, send one link. It is encrypted in your browser, read once, then gone. Free, no account needed.
uselinkpilot.com
- Encrypted in your browser
- Burns after one view
- No account needed
2,185 npm downloads in the 30 days to 18 October 2026, across the CLI, SDK and MCP server. npm's public count
Use LinkPilot where you already work
One-time secret links and short links from Slack, from your browser toolbar, or from a terminal. Every app works on every plan, including Free.
The Chrome listing also installs in Brave, Edge, Opera and Vivaldi. Zapier is in private beta; Firefox, Raycast and WordPress are in store review. See all apps
- Burns after one open
- The key lives in the link fragment
- No account needed
- Passphrase on Pro
- Audit timeline on Pro
- Revoke any time
- Files encrypted the same way
- A link preview never burns it
Product tour
From paste to burned, in four steps.
Everything below is the real product: screenshots from a demo workspace and the exact copy the pages use.
Paste a password, a key or a file.
It is encrypted in your browser before anything is sent, so what reaches us is ciphertext. Set the expiry and the view limit; passphrases and custom expiry dates are on Pro.
uselinkpilot.com/app/secrets/new
Sensitive links don't belong in Slack.
The shortcuts you reach for every day — DMs, email threads, shared docs — leave a permanent trail you can't take back.
- A password left in Slack is there until someone deletes it.
- A link that still opens tomorrow, and next year.
- No way to take it back once it is sent.
- No record of whether it was ever read.
Staging URLs
You share a preview URL with a contractor. The project ends. The link lives in your Slack history forever, accessible to anyone with archive access.
API keys
You DM an API key to a teammate. Now it exists in two inboxes, searchable, forwardable, and outside your control.
One-time access
You send a download link to a client. They forward it. Now three people you don't know have access to a file that was meant for one.
Create a link that knows when to disappear.
Three steps. No setup, no agents, no infrastructure to maintain.
-
01
Paste a password, a key, or a file
Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
-
02
Send the link
One URL. The key after the # stays in the browser and never reaches our servers.
-
03
The stored secret is gone
The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.
Built for the moment a secret has to leave your hands.
Secret links are the headline. Each scene below is the product, drawn in code so it stays true as the app changes.
Burn
One view, then gone.
Every anonymous secret burns after the first open. Signed in, you choose the view limit and the expiry, and you can revoke a secret before anyone reads it.
Secure password sharingKey
The key lives in the link, not with us.
The part after the # stays in the browser; browsers never send it to a server. We store ciphertext only, so we cannot read a secret or bring one back.
Security architectureAudit
ProKnow when it was read.
Created, viewed, burned, revoked: each event on the timeline with a hashed IP address. The audit timeline, passphrases and custom expiry dates are Pro, $29/mo.
See ProApps
Make one where you already work.
From the Chrome toolbar or a Slack slash command. /secret replies only to you; the channel sees a link only if you press Post to channel. Zapier is in private beta; Firefox, Raycast and WordPress are in store review.
All appsDrop Links
Let people send you a message anonymously.
Share a Drop Link for questions, ideas or feedback. Each message is emailed to your verified address and then discarded; neither its text nor the sender is stored. Senders need no account.
Create a Drop LinkAlso a shortener
Branded short links on your own domain.
Custom slugs, expiry, QR codes and private click analytics, with the destination editable after the link is out in the world. Secret links and short links share a workspace but never a pipeline.
Every featureRule Studio and Trust Passport
Route every click, score every destination.
Send each click where it belongs, and let recipients verify a link before they trust it. Both ship on every plan.
Send German mobile visitors to the localized app-store page. Everyone else goes to the web signup.
One short link, read out loud. Rule Studio checks it for conflicts and simulates it before anything changes.
-
Rule Studio
Route by country, device, language, referrer or A/B test. Rules are written in plain English, checked for conflicts and run through a simulator before you publish.
-
Shadow mode
Evaluate a draft rule against real production clicks without changing where anyone lands, then compare outcomes before committing.
-
Trust Passport
Every destination gets a 0–100 trust score. A risky target can be locked, or shown behind a warning interstitial.
Proof you can check yourself.
No customer logos and no testimonials. Code, listings and a dated record instead.
Public packages and listings
- linkpilot on npm (CLI)
- @uselinkpilot/sdk on npm
- @uselinkpilot/mcp on npm
- Chrome Web Store listing
- Slack app install
The encryption code ships in the open-source CLI with its test vectors.
Recently shipped
- Light-first redesign, new mark, social cards on every page.
- Slack app with /secret and /shorten; public /slack page.
- Browser-side encryption for secret text and attachments.
Single-purpose note tools, compared.
The anonymous note tools do one job well. These are the rows where LinkPilot differs, taken from the Privnote and OneTimeSecret comparisons.
Single-purpose note tools
- Revoke an unread secret from a dashboardPrivnote has no revocation. OneTimeSecret can burn a secret through its API.
- A timeline of who opened it, and whenNot offered by Privnote; minimal on OneTimeSecret.
- Encryption you can locatePrivnote's claims cannot be checked (closed source). OneTimeSecret states that secrets are encrypted on its servers.
- Short links and Drop Links in the same workspace
LinkPilot
- Revoke an unread secret from a dashboardRevoke from the Secret Links list any time before it is read.
- A timeline of who opened it, and whenCreated, viewed, burned, revoked, with hashed IPs. Pro.
- Encryption you can locateAES-GCM in your browser, key in the URL fragment, code in the open-source CLI.
- Short links and Drop Links in the same workspaceBranded short links, QR codes and anonymous Drop Links next to your secrets.
Simple, transparent pricing
Start free, scale as you grow. No surprises.
Free
For individuals and side projects.
$0
- 50 links
- 1,000 clicks/mo
- 3 team members
- 5 secret links
- 1 Drop Link · 25 messages/mo per link
- Analytics for the last 7 days
- API access (1 key, 60 requests/hour)
Most Popular
Pro
Passphrases, custom expiry and the audit timeline for secret links.
$29/mo
Covers up to 10 team members: under $3 per person per month.
- Passphrase protection
- Custom expiry & audit
- 50 secret links
- Unlimited links
- 50,000 clicks/mo
- 5 custom domains
- 10 team members
- 10 Drop Links · 500 messages/mo per link
- Full analytics history
- Higher API limits (5 keys, 1,000 requests/hour)
Agency
For agencies managing multiple client workspaces.
$299/mo
- Everything in Pro
- Higher API limits (25 keys, 5,000 requests/hour)
- Up to 25 client workspaces
- Up to 10 agency seats
- All features unlocked across clients
- White-label branding roll-up
- Unlimited Drop Links · 5,000 messages/mo per link
- Optional PGP encryption for Drop Links
- Cross-client analytics dashboard
- PDF reports & exports
- Priority support
Agency Plus
For larger agencies with more clients and seats.
$799/moSee plan
Enterprise
For organizations with advanced needs.
CustomSee plan
The pricing page has the full plan comparison and FAQ.
Learn the model.
Three short reads, then the long answers if you want them.
Secret links vs password managers
Keep credentials in a manager; use a burning link for the moment one has to leave your hands.
ReadSecurity architecture
Where encryption happens, what is stored, what the server never sees, and the dates it changed.
ReadRead the long answers: what a one-time secret link is, how it differs from a password manager, and how LinkPilot comparesHide the long answers
What is a one-time secret link?
A one-time secret link is a URL that reveals its contents exactly once. You paste a password, an API key, or a short note, and LinkPilot encrypts it in your browser before anything is sent; the decryption key lives in the part of the link after the #, which browsers never transmit to a server. The recipient opens the link and reads the secret. That first open burns the stored ciphertext, so the same URL opened a second time shows a burned notice — to them, to you, and to anyone who finds it later in a chat log or inbox. Anonymous secrets expire on a short timer if nobody opens them. This is the pattern behind secure password sharing without an account, and it is free.
How is this different from a password manager?
A password manager is for credentials you keep: it stores them, fills them, and syncs them across your own devices. A one-time secret link is for the moment a credential has to leave your hands — the Wi-Fi password for a contractor, a database string for a new hire, a client's temporary login. The two complement each other. Pasting a secret into Slack or email leaves a copy in every inbox, backup, and search index it touches; sending the same secret through a link that burns after one view removes the copy as soon as it has been read. Many teams keep their own secrets in a manager and use LinkPilot to hand one of them to a person outside it, then let the link destroy itself.
Branded short links and click analytics, same workspace
LinkPilot also runs a full link shortener with branded short links on your own domain, with custom slugs, expiry, passphrase protection, and QR codes. Every click is recorded as privacy-first click analytics — country, device, referrer, bot versus human — with visitor IPs hashed daily rather than stored. The Free plan includes 50 short links and real analytics for the last seven days; custom domains and full history are on Pro. Secret links and short links live in the same workspace but on separate pipelines by design, so a password you share never ends up in campaign data.
What LinkPilot is not
Not a password manager: it does not store, fill or sync credentials you keep, it hands one of them to someone else and then destroys the copy. Not a file-hosting service: an attachment is tied to a secret and goes away with it. Not ad-tech: click analytics are aggregated, bot-filtered and based on hashed IPs, with no recipient cookies and no retargeting. The about page says the rest, including the one honest limit on when we could read a secret.
How LinkPilot compares
If you are choosing between LinkPilot and a single-purpose secret tool or a classic shortener, these pages set the features and prices side by side and say plainly when the other tool is the better fit.
- LinkPilot vs OneTimeSecretThe same burn-after-read primitive, plus revocation, an audit timeline, and team workspaces.
- LinkPilot vs PrivnoteSelf-destructing notes compared with one-time links that also carry files and passphrases.
- LinkPilot vs BitlyBranded short links and analytics side by side, and the secret-sharing workflow Bitly does not have.
Frequently asked questions
Is LinkPilot free?
Yes. The free plan is free forever: 50 short links, 1,000 clicks per month, 5 secret links, analytics for the last 7 days, and API access within Free caps. Custom domains, passphrase-protected secrets, and full analytics history are on Pro. You can also create anonymous short links and secret links from the free tools without signing up at all.
What are Secret Links?
Secret Links let you share sensitive data (passwords, API keys, notes) via one-time links. Once viewed, the content is permanently destroyed, and every creation, view, burn, and revocation is recorded in an audit timeline.
How do short links work?
When someone clicks your short link, we redirect them to the destination URL and record the click for your analytics.
How is LinkPilot different from Bitly?
Bitly is a link shortener; LinkPilot pairs branded short links and analytics with a separate secret-sharing workflow — burn-after-read, passphrase protection, expiry, and audit logs — which Bitly doesn't offer. LinkPilot's free plan includes real click analytics for the last 7 days; custom domains come with Pro.
How is LinkPilot different from OneTimeSecret or Privnote?
Those tools cover the one-time secret itself. LinkPilot adds what teams need around it: revocation from a dashboard, a per-secret audit timeline, team workspaces with roles, file attachments, and branded short links with analytics in the same product.
Is my data encrypted?
Secret payloads are encrypted in your browser: it encrypts the content with AES-GCM-256 before sending it, and the key travels in the part of the link after the #, which browsers never transmit. We hold ciphertext and no key, so we cannot read your secrets. Traffic is TLS-encrypted in transit, passphrases are hashed in your browser, and burned or expired payloads are irreversibly redacted. Attached files are encrypted the same way, though a file's name and size remain visible to us. Browser-side encryption shipped on 29 September 2026; secrets created before that date were stored as plaintext until they expired. The security architecture page has the precise model.
Can I self-host LinkPilot?
No. LinkPilot is a hosted service only, and the service itself is not open source. The MIT-licensed CLI encrypts a secret on your own machine before anything is sent, and the security architecture page lists exactly what reaches our servers. If self-hosting is a requirement, OneTimeSecret, Password Pusher, PrivateBin and Yopass are the usual choices.
Can I use my own domain?
Yes. Add a domain and we verify DNS and issue the SSL certificate for you.
How does multi-tenant work?
Each workspace is isolated with database row-level security. Create multiple workspaces for different clients or projects, each with its own links, domains, and team members.
Do you support API access?
Yes, on every plan. The REST API covers programmatic link creation and analytics retrieval. Free includes 1 API key and 60 requests per hour; Pro raises that to 5 keys and 1,000 requests per hour, and Agency to 25 keys and 5,000 requests per hour.
What happens if I hit a plan limit?
Your existing links keep redirecting — limits apply to creating new links and to analytics depth, not to whether your links resolve. The dashboard shows a clear upgrade path when you reach a limit.
Send the next password as a link that burns.
Free, no account needed. Pro adds passphrases, custom expiry dates and the audit timeline for $29/mo.