Developer Rizz tool
Secret Share
Share API keys that self-destruct after one view 🔥
Share a secret as browser-encrypted ciphertext with a one-time claim and selected expiry. Keep in mind that anyone with the complete link can claim it.
How to use Secret Share
- Paste the secret and pick a self-destruct timer 🔐
- It's encrypted in your browser — we only ever store scrambled ciphertext.
- Send the link. First view destroys it forever. 🔥
What this tool does
Browser encryption
AES-GCM encryption happens in the browser. The key is placed in the URL fragment, which browsers do not include in HTTP requests.
One-time claim
A verified claim atomically deletes the stored ciphertext; expired secrets are also cleaned up.
Self-destruct timer
Unviewed secrets auto-delete after 1 hour to 7 days — whatever you pick.
Common uses
- Send a password, API key, or recovery code without putting plaintext in chat history.
- Set a short expiry for a one-time encrypted message.
Processing and privacy
Browser processing: The secret is encrypted with AES-GCM in the browser; the decryption key is placed in the URL fragment, which is not sent in HTTP requests.
Server processing: Ciphertext, IV, key verifier, and expiry are stored on the RizzKit server until a verified one-time claim or expiry cleanup; plaintext and the decryption key are not stored there.
Limitations to know
- Anyone with the complete link can decrypt and claim the secret.
- The recipient cannot recover a secret after the first successful claim or expiry.
- Endpoint security, compromised devices, screenshots, and copied plaintext remain outside the tool's protection.
Keep original files where applicable, inspect the result, and do not rely on an automated output without checking that it fits your intended use.
Practical tips
- Send the link and the context ("staging DB password") in separate messages or channels for extra safety.
- If the recipient says the link was already used and they didn't open it — rotate that key immediately.
Frequently asked questions
Can RizzKit read my secret?
The browser encrypts the secret before upload and keeps the decryption key in the URL fragment. The server stores ciphertext, an IV, a verifier, and expiry—not the plaintext or decryption key.
What happens after it is viewed?
A successful verified claim deletes the stored ciphertext. Treat the link as sensitive: anyone with the full URL can attempt to claim it.
Related tools and guidance
- Password Generator — Generate strong passwords and memorable passphrases.
- UUID Generator — Generate UUID v4 and time-ordered UUID v7 values.
- How to generate and handle strong passwords — Use browser-generated randomness, favor length and uniqueness, store credentials safely, and understand what a one-time secret link protects.