Sanctum Vault / One-time secret sharing

Share a secret. Once.

Send a password or access code through a link that can be revealed once. Choose an expiry and add a passphrase when you need one.

Open Vault See how it works ↓

Live tool · open in your browser

Vault share form with a clearly fictional access code, 24-hour expiry and optional passphrase control. — Actual interface · fictional data in an isolated demo.

One-time reveal
1-hour, 24-hour or 7-day expiry
Optional passphrase

The actual experience

A small handover. A clear finish.

See the actual share-and-reveal journey using fictional data. All steps work without watching the optional walkthrough.

18-second silent sequence from real interface captures, using an isolated demo. Pauses between states do not represent task speed. The same steps are described below; playback is optional. Open larger video

Step 1
Create a link.
Paste the value, choose an expiry and create a one-time link. Send that link through a channel you trust.

Actual Vault interface · fictional demo data.
Step 2
Reveal it once.
The recipient opens the link and deliberately chooses Reveal Secret. A passphrase is required if one was set.

Actual Vault interface · fictional demo data.
Step 3
No second reveal.
On a second visit, the same link is unavailable. One-time access does not stop someone copying or saving a value after seeing it.

Actual Vault interface · fictional demo data.

How it fits your work

Set the terms of the handover.

Choose the expiry.

Pick 1 hour, 24 hours or 7 days. An unused link becomes unavailable when its expiry is reached.

Add a passphrase.

If you set a passphrase, the recipient must enter it before the value is revealed. Share it separately from the link.

Before we start

Useful answers.

Does anyone need an account?

The public share/request interface opens without sign-in. Anyone holding a valid share link can attempt a reveal; a passphrase-protected link also needs the passphrase.

How is secret content protected?

Stored secret content is encrypted on the server using AES-256-GCM. The service decrypts it to deliver the value; this is not an end-to-end or zero-knowledge claim. Protect links and use the optional passphrase where appropriate.

Can the recipient keep a copy?

Yes. One-time describes retrieval from Vault. It cannot prevent copying, saving or photographing a value after it has been revealed.

Is this a password manager?

Vault is designed for a time-limited handover, rather than a long-term credential catalogue. Team deployment, notification delivery and integration requirements should be agreed separately.

Start with a real use case

Ready for the next handover?

Open the tool to share or request a secret. Talk to us if your team needs a deployment or integration plan.

Open Vault ↗ Discuss a team setup ↗