OOShare — Open Source Secure One-Time Secret Shari
DHDTech.io has created OOShare (Only Once Share), an open-source secure secret sharing platform found at ooshare.io. This project addresses a prevalent challenge that hasn't received adequate attention: the secure sharing of sensitive information—such as passwords, API keys, and credentials—without revealing it through email, Slack, or other lasting communication channels. At its core, the platform employs a zero-knowledge architecture for security. All encryption occurs client-side in the browser using AES-256-GCM via the Web Crypto API, ensuring the server never accesses plaintext, only encrypted data. The encryption key is included in the URL fragment, which is never sent to the server, preventing even the infrastructure operator from decrypting the secret. The cryptographic framework is robust: a master key is created for each share link, with a unique key per secret derived using HKDF-SHA-256 tied to the secret's UUID. Additionally, the secret ID is included as AES-GCM additional authenticated data to avert ciphertext swapping or ID manipulation. When the secret is accessed, it is atomically removed using Redis GETDEL, making it impossible to view it more than once. Secrets have a configurable time-to-live (TTL) ranging from 1 to 72 hours, ensuring they expire automatically even if they remain unopened. The technology stack is uncomplicated, featuring a React 19 + TypeScript frontend developed with Vite, a Flask 3 API, and Redis for temporary storage. The whole platform operates in Docker Compose and can be self-hosted by any organization with compliance or data residency needs. The application supports full internationalization across six languages—English, Portuguese, Spanish, Chinese, Hindi, and Arabic—with language preferences retained in share links, so recipients view the page in the sender's chosen language. The codebase is accessible on GitHub under the MIT license.