Secrets are encrypted in your browser (AES-256-GCM) before anything leaves your device. The key lives in the URL fragment (#), which browsers never send to the server. Key derivation uses HKDF-SHA256 with separate keys for encryption and auth.

No tracking, no cookies, no accounts. Open source (MIT). Runs on a $10 VPS — Go stdlib, Redis, static Next.js.

CLI included: printf 'db_password' | 1time send Self-hosting: 4-line Docker Compose (amd64 + arm64).

Would love feedback on the crypto approach and UX.

Live: https://1time.io | Source: https://github.com/shingrus/1time