Generate encrypted one-time links for sharing passwords securely with AES-256-GCM encryption in URL fragments.
Encrypt a password in your browser and hand the recipient a link that stops working after the first view. The password is sealed with AES-256-GCM before anything leaves your machine, and everything needed to decrypt - ciphertext and key - rides in the URL fragment, the part after the # that browsers never send to a server. The host therefore never receives the plaintext or the key, so it cannot read the secret or know who opened the link. The surprise is that the link itself is the secret: anyone who sees the URL - chat history, email archives, a screenshot - can open it and take the password.
The password is encrypted with AES-256-GCM in your browser before anything is sent. GCM is an authenticated encryption mode: it produces a ciphertext plus a tag, and the tag makes any alteration of the ciphertext detectable when the recipient decrypts. The material needed to decrypt rides in the URL fragment, the part after the #, which RFC 3986 defines as client-side only - browsers never transmit it to the server.
The link is bound to a server-side record that is destroyed on the first open, so the same link can never be used twice and stale links stop working. One-time is enforced at the server, not in the recipient's browser: nothing stops whoever opened it from copying the password first. If the wrong party opens it first - an accidental tap, a link-preview bot - the intended recipient gets nothing.
No, not in practice. The design that keeps the server from reading the secret - the key never reaches it - also means the server cannot manage or unsend the link on your behalf beyond the one-time deletion. Treat a sent link as a password already handed over: if delivery went wrong, rotate the password and send a new link.
The encryption protects the secret from the server and from anyone who sees traffic, because the fragment carrying the key is never transmitted. But your chat or email client stores the full link, key included, so anyone with access to that archive can open it. The link is safe against interception, not against people who can read your messages.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.