One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser
Go to file
2024-03-14 10:40:25 +01:00
.github/workflows [ci] Add GHCR publishing 2024-03-02 11:14:14 +01:00
ci Update dependencies 2024-03-14 10:33:50 +01:00
cmd/ots-cli Update dependencies 2024-03-14 10:33:50 +01:00
docs Release: OTS v1.12.0 2024-01-24 20:21:22 +01:00
frontend Port frontend to Bootstrap 5.3, split components 2023-09-30 23:18:34 +02:00
pkg Update dependencies 2024-03-14 10:33:50 +01:00
src Add Italian translation (#173) 2024-03-14 10:40:25 +01:00
.dockerignore [#46] Remove external font deps, add SRI checks (#47) 2021-09-26 14:49:18 +02:00
.eslintignore Fix some linter errors, use blob URL for download 2023-09-23 17:11:28 +02:00
.eslintrc.js Switch to esbuild & NodeJS 18 2023-06-10 16:20:46 +02:00
.git_changerelease.yaml [ci] Add GHCR publishing 2024-03-02 11:14:14 +01:00
.gitignore Add automated Issue generation for missing translations (#119) 2023-10-05 15:29:06 +02:00
.golangci.yml CI: Add code linting (#118) 2023-10-04 22:53:29 +02:00
api.go Fix: Use a default maxSecretSize and limit the payload read (#144) 2023-10-25 10:11:54 +02:00 Initial API 2017-08-03 14:13:53 +02:00
docker-compose.yml Release: OTS v1.12.0 2024-01-24 20:21:22 +01:00
Dockerfile [ci] Add GHCR publishing 2024-03-02 11:14:14 +01:00
Dockerfile.minimal [ci] Add GHCR publishing 2024-03-02 11:14:14 +01:00
go.mod Update dependencies 2024-03-14 10:33:50 +01:00
go.sum Update dependencies 2024-03-14 10:33:50 +01:00
helpers.go Implement metrics collection for API server (#143) 2023-10-23 14:05:20 +02:00 Release: OTS v1.12.0 2024-01-24 20:21:22 +01:00
i18n.yaml Add Italian translation (#173) 2024-03-14 10:40:25 +01:00
LICENSE Fix LICENSE file 2018-05-05 18:10:10 +02:00
main.go Implement metrics collection for API server (#143) 2023-10-23 14:05:20 +02:00
Makefile [#158] Disable Vue Devtools in release builds 2023-12-12 23:18:19 +01:00
package-lock.json Update dependencies 2023-11-18 19:10:45 +01:00
package.json [#115] Implement Binary File Attachments (#116) 2023-10-02 21:52:24 +02:00 [ci] Add GHCR publishing 2024-03-02 11:14:14 +01:00 Add security policy 2023-07-05 16:49:58 +02:00
storage.go Implement metrics collection for API server (#143) 2023-10-23 14:05:20 +02:00
tplFuncs.go CI: Add code linting (#118) 2023-10-04 22:53:29 +02:00

Luzifer / OTS

ots is a one-time-secret sharing platform. The secret is encrypted with a symmetric 256bit AES encryption in the browser before being sent to the server. Afterwards an URL containing the ID of the secret and the password is generated. The password is never sent to the server so the server will never be able to decrypt the secrets it delivers with a reasonable effort. Also the secret is immediately deleted on the first read.


  • AES 256bit encryption
  • Server does never get the password
  • Secret is deleted on first read


For a better setup you can choose the backend which is used to store the secrets:

  • mem - In memory storage (wiped on restart of the daemon)
  • redis - Storing the secrets in a hash under one key
    • REDIS_URL - Redis connection string redis://USR:PWD@HOST:PORT/DB
      (pre Redis v6 use auth as user, afterwards use a user available in your ACLs)
    • REDIS_KEY - Key prefix to store the keys under (Default io.luzifer.ots)
  • Common options
    • SECRET_EXPIRY - Expiry of the keys in seconds (Default 0 = no expiry)


To shorten the README this documentation has been moved to the Wiki:

Creating secrets through CLI / scripts

As ots is designed to never let the server know the secret you are sharing you should not just send the plain secret to it though it is possible.


Download OTS-CLI from the Releases section of the repo or build it yourself having a Go toolchain available from the ./cmd/ots-cli directory.

Afterwards you can just create and fetch secrets:

# echo "my password" | ots-cli create
INFO[0000] reading secret content...                    
INFO[0000] creating the secret...                       
INFO[0000] secret created, see URL below                 expires-at="2023-10-16 16:33:27.422174121 +0000 UTC"

# ots-cli fetch ''
INFO[0000] fetching secret...                           
my password

To set the instance to send the secret to or to attach files see ots-cli create --help and to define where downloaded files are stored see ots-cli fetch --help.

Both commands can be used in scripts:

  • create reads from STDIN or the specified file and yields the URL to STDOUT
  • fetch prints the secret to STDOUT and stores files to the given directory
  • both sends logs to STDERR which you can disable (--log-level=fatal) or ignore in your script

In case your instance needs credentials to use the /api/create endpoint you can pass them to OTS-CLI like you would do with curl:

  • ots-cli create --instance ... -u myuser:mypass for basic-auth
  • ots-cli create --instance ... -H 'Authorization: Token abcde' for token-auth (you can set any header you need, just repeat -H ...)

This is slightly more complex as you first need to encrypt your secret before sending it to the API but in this case you can be sure the server will in no case be able to access the secret. Especially if you are using (my public hosted instance) you should not trust me with your secret but use an encrypted secret:

# echo "my password" | openssl aes-256-cbc -base64 -pass pass:mypass -pbkdf2 -iter 300000 -md sha512

# curl -X POST -H 'content-type: application/json' -i -s -d '{"secret": "U2FsdGVkX18wJtHr6YpTe8QrvMUUdaLZ+JMBNi1OvOQ="}'
HTTP/2 201
server: nginx
date: Wed, 29 Jan 2020 14:08:54 GMT
content-type: application/json
content-length: 68
cache-control: no-cache


You will now need to supply the web application with the password in addition to the ID of the secret:|mypass

In this case due to how browsers are handling hashes in URLs (the part after the #) the only URL the server gets to know is which loads the frontend. Afterwards the Javascript executed in the browser fetches the encrypted secret at the given ID and decrypts it with the given password (in this case mypass). I will not be able to tell the content of your secret and just see the AES 256bit encrypted content.

Localize to your own language

If you want to help translating the application to your own language please see the i18n.yaml file from this repository and translate the English strings inside. Afterwards please open an issue and attach your translation including the information which language you translated the strings into.

Of course you also could open a pull-request to add the new translations to the i18n.yaml file.

Same goes with when you're finding translation errors: Just open an issue and let me know!

The format for the i18n.yaml is as follows:

reference:                 # Reference strings (English)
  deeplLanguage: en        # Source language for DeepL automated translations
  languageKey: en          # Browser language to use this translation for
  translations: {}         # Map of translation keys to their translations

translations:              # Translations into other languages
  de:                      # Identifier for the language, used as `languageKey`
    deeplLanguage: de      # Target language for DeepL automated translations
    translators: []        # Array of Github usernames who "own" the translation
                           # and are pinged in the translation issue when there
                           # are translations missing (as of new features being
                           # added or features being improved). Add your username
                           # to this array to get pinged by the bot when stuff
                           # needs to be translated.
    translations: {}       # Informal / base translations for the language.
                           # Missing keys will be loaded from the `reference`
                           # and therefore get displayed in English. Missing
                           # keys can be generated through DeepL through the
                           # translation tool included in `ci/translate` but
                           # will have low quality as partial sentences or
                           # even only words lack the context for the
                           # translation
    formalTranslations: {} # Formal translations for the language (these will
                           # be merged over the `translations` for this language
                           # so you don't have to copy keys being equal in formal
                           # and informal translation.)