send-secret-file

Secure file sharing with a one-time link is done by running the npx send-secret CLI on a local file path, which encrypts the data locally and generates a self-destructing URL. The decryption key is embedded in the URL fragment.

AES-256-GCM encryption is applied locally before the file is uploaded, ensuring the contents are never exposed to servers or agents. The decryption key is embedded directly in the URL fragment, allowing only the recipient to decrypt the file.

You can send encrypted files to single or multiple recipients using a self-destructing link. The CLI supports both per-view and time-based access constraints to control how long the one-time link remains active.

No dependencies are required to generate a secure one-time link. You can use the npx send-secret CLI workflow directly to locally encrypt your file and produce the URL without a permanent installation.

The best way to transmit credentials is using local AES-256-GCM encryption combined with a one-time link. This approach ensures sensitive files are never exposed to servers, and the decryption key is safely embedded in the URL fragment.

A limitation of using URL fragments for secure file sharing is that the decryption key is embedded in the fragment, which is not sent to the server but requires the recipient to use the exact full URL to access and decrypt the file.