OTS

OTS is an open-source, self-hosted application that facilitates the sharing of sensitive information through encrypted one-time secrets. The system ensures that data is deleted immediately after the first read, preventing long-term storage of credentials or private keys on the server.

The software operates as a server with a web-based frontend for browser access. It is designed to be deployed as a standalone binary or via a Docker image. In addition to the web interface, it provides a dedicated command-line interface that allows users to create and fetch secrets through terminal commands or automated scripts.

Key features

• AES-256 symmetric encryption performed in the browser
• Automatic deletion of secrets after the first read
• Zero-knowledge architecture that prevents the server from receiving plain text
• Support for in-memory or Redis storage backends
• Configurable secret expiration settings
• Dedicated CLI tool for secret creation and retrieval
• API endpoints for programmatic secret management
• Authentication options for API access including basic-auth and tokens

Developed in Go, the server manages the storage and delivery of encrypted payloads. The decryption process occurs entirely on the client side, meaning the password is never transmitted to the server and remains in the browser hash. For deployment, the application can be run as a binary or via a Docker image from the GitHub Container Registry. The storage backend can be toggled between a volatile memory system, which is wiped on restart, or a Redis hash for different persistence needs. The application also supports internationalization through a YAML-based translation system, allowing the interface to be localized into multiple languages.

Users can integrate the tool into their workflows using the OTS-CLI, which reads from standard input and yields URLs to standard output. This makes it suitable for developers and system administrators who need to pass sensitive data between environments without leaving a permanent trace. The system can also be used with external tools like OpenSSL to manually encrypt secrets before they are sent to the API.

This tool is intended for users who require a secure method to transmit temporary credentials or secrets without storing them in plain text on a server.