EINMALPOST

Share passwords and confidential data safely

One text or file, one link, a single retrieval. Encryption happens in your browser — the server never sees the content. After that it is gone.

OR A FILE

Up to 16 MB. A file is encrypted just like a text — we see neither its contents nor its name.

How einmalpost works

  1. Enter your text

    Your browser creates a key and encrypts the text with it. Both happen on your device, before anything is sent.

  2. Share the link

    The key sits after the hash mark of the link. Browsers do not send that part to servers — we never get to see it.

  3. Read once

    Whoever opens the link and presses Reveal sees the content a single time. In the same moment, the server deletes it.

Why a password has no business being in a chat message

Credentials are rarely shared deliberately — they slip into a message because things need to move fast. And there they stay: in the chat history, in the mailbox backup, in the inbox of a colleague who forwarded it. Anyone who gains access to one of those months later still finds the password.

einmalpost turns that around: the content does not live in the message but behind a link that destroys itself on first retrieval. What remains in chat and mail is a link that leads nowhere. And because encryption happens in your browser, there is nothing to take from us either: the server holds ciphertext without a key.

This does not replace a password manager for lasting access. For the one credential you need to hand over right now, it is the shorter path.

Frequently asked questions

Can the server read my message?

No. Your text is encrypted in your browser before it leaves your device. The key sits only in the part of the link after the hash mark, and browsers do not send that part to servers. What the server holds is ciphertext it cannot read.

Do I need an account?

No. There is no sign-up, no registration and no email address. You write something and you get a link.

Can I trust einmalpost?

Only so far — and we would rather say that than hide it.

The encryption runs in your browser, but the JavaScript doing it comes from our server. A tampered server could serve code that sends the key along, and you would not notice. That is true of every service of this kind, including the well-known ones.

What you can do about it: the source code is open. You can compare what you are served, and you can run einmalpost on your own server. What we cannot do is prove it to you.

What if someone intercepts the link?

Then they have everything. The link contains the key — anyone who reads it in full can open the content. Once, like anyone else.

So avoid sending the link through the same channel as the note explaining what it is. Use a passphrase where that matters. And if your recipient opens the link and the content is already gone, you have learned something useful: somebody was there first.

Does the link stay in my browser history?

Yes. The content is deleted after being shown, but the address including the key remains in the browser history — yours and the recipient's — and usually in the message you sent it with.

Once the content has been retrieved, the key is useless to anyone. Until then, the link is exactly as confidential as the content.