passwd.page
give agents secrets without pasting them into prompts
Last verified:
What is passwd.page?
passwd.page is a zero-knowledge secret handoff tool designed for secure sharing of passwords, API keys, SSH keys, env files, and other sensitive credentials between humans and AI agents. It encrypts secrets on your device using AES-256-GCM before they leave your browser, CLI, or agent, ensuring the encryption key never touches their servers. The service provides self-destructing links that are destroyed after the first retrieval, with no copies, backups, or traces left on the server.
Key features include QR codes on every link for easy mobile access, file sharing up to 1 MB (SSH keys, .env files, certificates), optional passphrase protection with PBKDF2 hardening, typed secrets with eight schema types (api_key, postgres_url, etc.), configurable TTLs from 5 minutes to 30 days, and self-hosting capability via Docker in 60 seconds. The tool offers three usage methods: browser interface, CLI for terminal/scripts, and MCP tool server for AI agents.
passwd.page is for developers, DevOps engineers, security professionals, and anyone working with AI agents who needs to share secrets without pasting them into prompts (which get logged), Slack-ing plaintext files, hardcoding in configs, or giving agents full vault access. It solves the problem of secure ephemeral secret sharing for human-to-human, human-to-agent, agent-to-human, and agent-to-agent workflows.
The service requires no signup, no app, no subscription, and is completely free and open source. It is truly zero-knowledge (mathematically impossible for the server to read secrets), consists of a single self-hostable Go binary, is built for automation with CLI pipes/MCP tools/REST API, and has nothing to remember (no accounts, master passwords, or subscriptions).
passwd.page pricing
Pricing model: Freemium
Completely free and open source. No signup, no app, no subscription required. All features including QR codes, file sharing up to 1 MB, optional passphrase, typed secrets, and configurable TTLs are included in the free tier. Self-hosting is also free with no license costs.
passwd.page pros
- Zero-knowledge encryption - mathematically impossible for server to read secrets
- AES-256-GCM encryption runs entirely on your device
- Encryption key never touches their servers
- Self-destructing links - destroyed after first read with no backups
- QR code on every link for easy phone access
- File sharing up to 1 MB for SSH keys, .env files, certs
- Optional passphrase with PBKDF2 hardening as second factor
- Eight typed secret types with schema hints for agents
- Configurable TTLs from 5 minutes to 30 days
- Self-host in 60 seconds with docker compose
- No signup required
- No app installation needed
- No subscription fees - completely free
- Open source - verify the security yourself
- Single Go binary with embedded frontend
- CLI available for terminal and script automation
- MCP tool server for AI agent integration
- REST API for workflow automation
- No accounts or master passwords to remember
- Encrypted in browser before leaving your device
passwd.page cons
- File size limit of 1 MB maximum
- Requires internet connection to use
- Self-hosting requires Docker knowledge
- No persistent storage - secrets burn after first read
- Passphrase feature is optional (not enforced)
- Only 8 secret types available
- TTL minimum is 5 minutes (no instant expiration)
- Single binary may limit customization options
Frequently asked questions about passwd.page
How do I share a password securely?
Paste it into passwd.page, get a link, and send the link. passwd.page encrypts the password in your browser with AES-256-GCM and gives you a one-time secret link. The decryption key lives only in the URL fragment and is never sent to the server. The recipient opens it once and the secret self-destructs.
What is a one-time secret link?
A URL that reveals a shared secret a single time, then burns after reading. No copies in Slack, no plaintext in email, nothing left to leak from chat history. Perfect for ephemeral secret sharing like temporary passwords, API keys, and database URLs.
Is it really zero-knowledge?
Yes. Encryption runs on your device and the key never reaches their servers. They only store opaque ciphertext, so they are mathematically unable to read your secrets even under subpoena or breach. It's open source, so you can verify it yourself.
Can AI agents share secrets with it?
Yes. An MCP tool server with share_secret, share_file, and retrieve_secret functions, a CLI, and a REST API let agents hand off short-lived credentials without ever pasting them into a prompt.
How is this different from emailing a password?
Email and chat keep secrets in plaintext forever, searchable and accessible to admins and compliance tools. passwd.page secrets are end-to-end encrypted, expire on a timer (5 minutes to 30 days), and can self-destruct on first read.
What file types can I share?
You can drag and drop any file up to 1 MB, including SSH keys, .env files, certificates, and other sensitive configuration files. Files are encrypted in your browser before they leave your device.
What TTL options are available?
Five-minute TTLs for when your agent needs a token right now and never again. Also available: 15 minutes, 1 hour, 24 hours, 7 days, and 30 days.
What are the typed secret types?
There are eight types that tell the receiving agent what kind of secret it is, providing schema hints for the agent era. Examples include api_key and postgres_url. This helps agents understand the secret's schema without exposing the actual value.
How do I self-host passwd.page?
Use docker compose up -d to self-host in 60 seconds. Alternatively, you can drop the systemd unit. See SELF_HOSTING.md for detailed instructions. It's a single Go binary that embeds the entire frontend with no external dependencies.