OneTimeSecret vs Privnote
Two of the best-known ways to send a self-destructing message. They differ on where encryption happens, on plans, and on open source.
The short answer
- Choose Privnote for a free, no-account note encrypted in your browser, with an optional email when it's destroyed.
- Choose OneTimeSecret for open-source code you can self-host, a choice of data regions, custom domains and team plans.
- Neither describes a per-link access log or a working way to collect secrets. For work handoffs, consider CredenShare.
Who this page is for: people choosing a quick way to send one secret.
OneTimeSecret vs Privnote at a glance
| OneTimeSecret | Privnote | |
|---|---|---|
| Price | Basic €0; Identity Plus €35/month; Team Plus €125/month | Free (ad-funded) |
| Account needed | No, for basic use | No |
| Where it's encrypted | On OneTimeSecret's servers, in transit and at rest; no algorithm named | In your browser, before storage |
| Open source | Yes (MIT); self-hostable | No |
| Maximum lifetime | 7 days without signing in; 14 on Free; 30 on paid plans | 30 days; unread notes are then removed |
| Views | Once, then destroyed | Once by default; with a time option (1 hour, 24 hours, 7 or 30 days), any number until it expires |
| Passphrase | Optional | Optional manual password |
| Notification | Not described | Optional email when the note is destroyed |
| IP addresses | Not stated | Not logged, per its privacy policy |
| Data regions | EU, UK, US, CA, NZ | Not stated |
| Teams | Team Plus: SSO, roles, members | None |
Checked on October 23, 2026 against each service's own pages; see the sources below.
Which is more private, OneTimeSecret or Privnote?
They encrypt in different places. Privnote encrypts the note in your browser; the decryption key is part of the link, which its privacy policy says is never sent to Privnote, and it says it doesn't log IP addresses. OneTimeSecret says secrets are "securely encrypted on our servers", in transit and at rest on every plan, without naming the algorithm. Its code is open source (MIT), so you can read it, or run your own copy with Docker and Redis.
How long do links last?
- OneTimeSecret links are viewable once, then destroyed. They last up to 7 days without signing in, 14 days on the free account, and 30 days on paid plans.
- Privnote notes self-destruct after the first reading by default. You can instead pick 1 hour, 24 hours, 7 days or 30 days; the note can then be opened any number of times until that time is up. Unread notes are removed after 30 days.
Which suits a business?
OneTimeSecret has paid plans: Identity Plus (€35 a month) adds unlimited custom domains, and Team Plus (€125 a month) adds SSO, roles and teams. It offers a REST API and a choice of data regions. Privnote is a free, ad-funded service with no accounts, teams or API.
Can either collect a secret from someone?
OneTimeSecret lists "incoming secrets" on its plans, but its docs describe the feature as "a work in progress". Privnote has no request feature.
Which should you pick? Scenarios
| Your situation | Better fit | Why |
|---|---|---|
| A quick personal note, no sign-up | Privnote | Free, browser-side encryption. |
| A strict single view with an expiry date | OneTimeSecret | Privnote's timed notes allow repeat views. |
| You want to self-host | OneTimeSecret | MIT-licensed code. |
| Data must stay in the EU or UK | OneTimeSecret | Regional hosting. |
| Your own domain on links | OneTimeSecret | Custom domains. |
| Proof a work handoff arrived | Neither | No per-link access log described. |
What neither OneTimeSecret nor Privnote covers
- A record of who opened a link, when and from where. Privnote can email you when a note is destroyed; OneTimeSecret's audit trail is marked beta or "coming soon".
- Collecting a credential from a client or vendor. OneTimeSecret's incoming secrets are a work in progress; Privnote has none.
- Links that start counting at the first open, for recipients who act days later.
CredenShare is built for work handoffs, in both directions:
- Encryption in your browser (AES-256-GCM) for shares made in the web app, API and SDKs; the key travels after the
#in the link. Slack-created shares are encrypted on our servers. - Access logs for every share: views, times and IP addresses, kept 3 to 180 days by plan.
- Expiry from 1 hour to 3 months, optionally counted from the first open, plus passcodes and view limits.
- Secure Requests (Business and Enterprise): a form with the fields you need, encrypted in the submitter's browser.
- Teams, Slack, a browser extension, a REST API, SDKs and an MCP server for AI agents.
The Free plan covers 3 shares a day. See pricing.
Before you share a credential: a checklist
These apply whichever tool you use.
- Send the link and the passcode through different channels. For example, the link by email and the passcode by text message.
- Watch out for link scanners. Some email security filters and chat apps open links automatically, which can use up a one-view link. Send the link as plain text through a channel that doesn't pre-open links, or allow a second view with a short expiry.
- Don't open the link to test it. On a one-view link, your test is the view.
- Pick the shortest expiry that works. If you don't know when the recipient will act, a link that starts counting at the first open is safer than a long fixed window.
- Rotate after the handoff when you can. The link expires, but the credential is still valid.
- Keep the original in your password manager. A sharing link is a delivery method, not storage.
Verdict: OneTimeSecret or Privnote?
- Pick Privnote for a free, quick, browser-encrypted note.
- Pick OneTimeSecret for open source, self-hosting, data regions and team plans.
- For work handoffs that need a record or a request, look at CredenShare.
Related: CredenShare vs OneTimeSecret · CredenShare vs Privnote · Password Pusher vs OneTimeSecret
Sources (checked October 23, 2026):
- OneTimeSecret: pricing, docs, data protection, secret links, compare plans, incoming secrets, GitHub
- Privnote: note options, about, privacy policy
OneTimeSecret, Privnote are trademarks of their respective owners. CredenShare is not affiliated with any of them.
Frequently asked questions
A one-time link, with a record
Browser-encrypted shares with access logs. Start on the Free plan.