Comparing secret-sharing tools honestly
| Secret Share | onetimesecret | Bitwarden Send | PrivateBin | Magic Wormhole | |
|---|---|---|---|---|---|
| End-to-end encrypted | Yes, always | Only with an optional passphrase; otherwise server-side encryption | Yes | Yes | Yes (PAKE) |
| Read-once / burn after reading | Always | Yes | Optional (max access count) | Optional | Inherent (direct transfer) |
| Direct P2P transfer | Yes, when both online | No | No | No | Yes (with relay fallback) |
| Works if recipient is offline | Yes (encrypted drop) | Yes | Yes | Yes | No — both ends live |
| Force-direct option (secret never stored on a server, even encrypted) | Yes — one checkbox; requires both parties online | No — server storage is the model | No — server storage is the model | No — server storage is the model | Never stored by design, but the relay fallback (which streams ciphertext) can't be switched off |
| No account needed to send | Yes | Yes (basic use) | Account required | Yes | Yes |
| Speakable code (no link required) | Yes — 5 words | Link (+optional passphrase) | Link | Link | Yes — wormhole code |
| QR code for phone handoff | Yes | No | No (requested feature) | Yes | Yes (--qrcode) |
| Files / large payloads | Small files & text up to 10 KB (up to 4 MiB offline via QR) | Text-focused | Yes (files need premium) | Text/attachments (instance-dependent) | Yes, any size |
| Interface | Web + CLI (npx shareasecret) |
Web | Web/apps | Web | CLI (third-party GUIs exist) |
| Branded portal for your company (your domain + SSO) | Yes — white-label with your own OIDC/SSO, from $49/mo | Custom domain on paid plans; SSO tier not publicly priced | No branded portal (org vaults instead) | No — self-host and theme it yourself | No |
| Self-hostable | No | Yes | Yes (server) | Yes — that's the point | Yes (relay) |
| Source | Source-available (GitHub, not OSI-licensed) | Open source | Open source | Open source | Open source |
When each tool is the right choice
- Magic Wormhole — you and the other person both live in a terminal, or you're moving big files. The PAKE-based code exchange is the gold standard, and transfers are direct. Its limits: both ends must be online simultaneously, and it's a CLI tool — not something you send your accountant.
- Bitwarden Send — you already pay for or use Bitwarden. It's well-audited and integrated with your vault; the trade-offs are that senders need an account and file sends need premium.
- PrivateBin — you want to run the server yourself. Client-side encryption with the key in the URL fragment, on your own infrastructure. You inherit the hosting and maintenance.
- onetimesecret — a long-established, simple choice. Note that end-to-end encryption applies only when you set a passphrase and share it out-of-band; without one, the server handles encryption.
- Secret Share (this site) — you want E2E encryption and read-once by default with nothing to install and no account, a code you can read over the phone or scan from a QR code, direct browser-to-browser transfer when both people are online, and a zero-upload mode when you don't want even ciphertext stored. Terminal people get the same protocol via
npx shareasecret— send from the CLI, open in a browser, or vice versa. Its limits, stated plainly: text up to 10 KB only, no self-hosting, and as with every web-delivered crypto tool you trust the JavaScript served at time of use (our mitigations: public source, a zero-upload mode, and the pinnable CLI).
The question that actually matters
"Is it end-to-end encrypted?" is the headline question, but the second one is just as important: what happens to the secret after it's read? Tools that default to read-once turn interception from a silent, permanent compromise into a visible, one-shot race. Whichever tool you pick from this table, prefer the configuration where the secret can be read exactly once and expires on its own.
Try the default-secure option — no account, encrypted in your browser, gone after one read.
Share a secret →