TheOwlBay
Secret link — encrypted paste
Encrypt in the browser · key stays in #hash · nothing uploaded
0 B
Anyone with the full link can read the secret. Do not post it publicly.
Secret link encrypts pasted text in your browser with AES-256-GCM, then puts the key and ciphertext in the URL hash. Send the full link privately so a teammate can open it once. TheOwlBay servers never receive the hash or plaintext. Choose how long the link should stay readable (soft expiry checked in the browser). This is not a password manager or team vault.
Why share secrets in a link instead of chat
Pasting live API keys into Slack or email leaves copies in search logs and backups. A secret link keeps the ciphertext inside the URL fragment, which your browser does not send to our CDN in the HTTP request. Anyone without the full URL cannot decrypt the text. Honest limits: anyone who has the full link can read it, and saved URLs may work after the expiry message if someone bypasses the page script.
How to create and open a secret link
Paste your .env snippet or message into the box. Pick an expiry window (default two days). Press Create encrypted link. Copy the full URL and send it in a private channel. Your teammate opens the same path with ?view=1 and the hash attached. They press Copy text if needed. If the paste is too long for one URL, shorten it or split into two links.
What happens under the hood
The page generates a random 256-bit key with crypto.getRandomValues, encrypts JSON that includes your text and expiry timestamp, and builds #k= and #d= parameters like Secret Santa assignment links. Decryption runs locally when the hash is present. We do not store secrets on TheOwlBay accounts or DynamoDB in this version.
Who this tool is for
Developers handing a staging .env to a contractor, ops sharing a one-off token, or anyone who needs a quick encrypted handoff without signing up for a pastebin service. Use the password generator on this site when you need a new random string, not when you need to deliver an existing secret.
FAQ
Does TheOwlBay see my secret?
No. Plaintext and the URL hash never hit our servers. Only the static page loads.
Can someone guess the link?
Not practically. The AES key has 256 bits of randomness. Without the full URL there is nothing to attack.
What happens after expiry?
The view page shows an expired message when the timestamp passes. Someone who saved the full URL might still decrypt offline.
Is this a password manager?
No. Use your vault for long-term storage. This is a one-off share link.
Need a new random password instead?
Open the password generator on Useful tools.