WebicsShare

Send a password once. Then it's gone.

Paste a password or login and get a secure link to send. It opens once, then it's destroyed for good.

0 of 10,000 characters

Shown to the person who opens the link. It's encrypted too.

Link expires after

Or as soon as it's opened, whichever comes first.

Add a passphrase (optional)

The link won't open without it. Send it separately, for example by text message, never in the same email as the link.

  • Encrypted in your browser before it's sent. We can't read it.
  • Opens once, then it's deleted for good. No copies, no backups.
  • Unopened links expire on their own, after 7 days at most.
  • Clients can use it to send passwords to us, too.

How Webics Share keeps it private

The password is scrambled on your device before it leaves, and the only key that can unscramble it is in the link you send. We never see the key, so we can never see the password.

  1. You encrypt it

    Your browser makes a brand new random key and encrypts what you typed. Only the encrypted version is sent to us.

  2. You send the link

    The key is in the part of the link after the # sign. Browsers never send that part to a server, so it reaches only the person you send the link to.

  3. They open it once

    They press Reveal. We hand over the encrypted copy and delete it in the same step, and their browser unlocks it. Open the link again and there's nothing there.

Encryption in your browser
AES-256-GCM, with a new 256-bit random key and a new 96-bit random starting value for every secret, made by your browser's built-in Web Crypto.
Where the key lives
Only in the link, after the # sign. It is never sent to Webics or stored anywhere.
Optional passphrase
Turned into a second key with PBKDF2-SHA256 over 600,000 rounds and a random 16-byte salt, then combined with the link key using HKDF-SHA256. Both the link and the passphrase are needed.
Encrypted again on our server
Before it's stored, our server wraps the already-encrypted copy in a second layer of AES-256-GCM using a server key. A copy of our database on its own is useless.
Tied to its own link
Both layers are bound to the link's unique ID, so an encrypted copy can't be moved to another link.
Opened once, then deleted
Reveal fetches and deletes it in a single step, so two people can never both open it. Unopened links are deleted when they expire.

What we keep, and what we never see

Stored until it's opened or expires

  • The doubly encrypted copy
  • The time it expires
  • A random ID for the link

That's all. No name, no email address, no IP address, no account. Once it's opened or expires, the row is deleted outright. There is no backup copy to restore.

Never sent to us

  • What you typed
  • The key in the link
  • Your passphrase
  • The "who is it for" note, which is encrypted with the password

This page loads no tracking or analytics. The only outside script is Cloudflare's spam check on this page, and the page someone opens a link on loads nothing from anywhere else at all.

Webics staff will never ask you for your bank details or card numbers. Anyone can use this tool, so a link from it is not proof a message came from us. If you're not sure, call us on 1300 932 427.