OOShare - Secure One-Time Secret Sharing

Overview

OOShare is a secret sharing platform built around privacy: it sends passwords, API keys, and sensitive messages through one-time links. The browser encrypts the secret with AES-256-GCM before it is stored, and the decryption key lives only in the URL fragment, never transmitted to the server. Once viewed, the secret is deleted from Redis atomically.

The Challenge

Teams routinely share credentials over Slack, email, or chat, channels that log messages indefinitely and expose secrets to breaches. Existing solutions were either too complex for non-technical users, or they required trusting a third-party server with plaintext data.

The Solution

We built a zero-knowledge architecture where the server only stores encrypted blobs. The master key travels exclusively in the URL fragment (after the #), which browsers never send to the server. A Flask + Redis backend handles storage with atomic GETDEL operations, while a React frontend does all the cryptography in the client with the Web Crypto API. Secrets auto-expire between 1 and 72 hours via Redis TTL.