API keys and integrations
Keys you need to hand to an IT partner, a developer or an automation provider.
A free tool from Areza Digital · open source
Send the password.
Keep it out of the inbox.
Paste a password, an API key or login details. Your browser encrypts it before it leaves your device, the recipient opens the link once, and our server never sees what is inside.
- Encrypted in your browser
- Opens once, then it is deleted
- No sign-up, no cookies, no tracking
How it works
The key stays in the link. The server never sees it.
A link has two parts. The first says where the encrypted text is stored. The second, after the # sign, is the key, and browsers never send that part to the server.
Encrypted in your browser
Your browser creates a one-time key and encrypts the text with it. Only encrypted text leaves your device.
The server keeps only encrypted text
We receive text we can't read and keep it only as long as you chose, 7 days at most.
Opened once
When the recipient opens the link, the encrypted text is deleted at once. For 7 days after that, the link shows when it was opened.
secret.areza.digital/s/k7Q2xY9pLm3vT8wB4nR1sA#AGE-SECRET-KEY-PQ-1QF3X7…
Sent to the serverwhere the encrypted text is
Stays in the browserthe key that unlocks it
The server sees
- Encrypted text
- When the link expires
- Whether it was opened
The server never sees
- Your text
- The key after the #
- Who you are: no accounts or cookies, IP not stored
When the client has the details
Ask for the password. Don't have it emailed.
Create a request and send the link to your client. They paste the details, their browser encrypts them with your key, and only you can read them.
The link itself is safe to email, because it holds no secret. Your client sees that the details were delivered, and later that you read them.
Verified: Areza Digital
Areza Digital is asking for:
Bank API key for statements
••••••••••••••••••••••••••••
Delivered14:02
Read by the requester14:05
What it is for
Logins that do not belong in an inbox.
Emails stay in inboxes, backups and forwarded threads. A one-time link has nothing left in it once it is opened.
App logins
A new user's login for accounting, CRM or any other business software.
Passwords for encrypted files
Sending a contract or a report as an encrypted ZIP or PDF? Send its password separately, here.
Bank and payment keys
Keys for automated bank statements and payment systems, when a partner needs them.
Security
What we protect, how, and what we can't.
Encryption
The open age format with hybrid post-quantum keys (ML-KEM-768 + X25519). Encryption runs in your browser, and we write none of the cryptography ourselves.
Read once
The encrypted text is handed out and deleted in a single step. There is no second read.
Expiry
From 1 hour to 7 days. Then everything is deleted except the opened-at record, kept 7 days after opening.
No third-party code
No analytics, ads, cookies or outside scripts on the page. Fonts and code load only from our own domain.
What it can't stop
If someone gets the link before the recipient, they can open it. The recipient will then see that it was already opened and know it may have been intercepted.
Verified requests
Requests from the Areza Digital team carry a “Verified” badge. Anyone can create other requests, so only send details to people you know.
Can you read my data?
No. The text is encrypted in your browser, and the key stays in the part of the link after the # sign, which browsers never send to the server. Your secret is stored only in encrypted form.
What happens if nobody opens the link?
When it expires, the encrypted text is deleted automatically. A link lasts 7 days at most.
Can I send files?
No: text only, up to 10,000 characters. Send the file encrypted and pass its password here.
What do you store about me?
The encrypted text, any request text (not encrypted), and when the link was created, expires and was opened. To limit abuse we count actions by a hash of your IP address that changes every day; we do not store the address itself. The site runs on Cloudflare, which keeps technical backups for up to 30 days. They hold no keys, so the secrets in them can't be read.
How much does it cost?
Nothing. We built it for our clients, and anyone can use it. The code is open source under the MIT License.
How can I check that this site runs the published code?
The code is published at https://github.com/areza-digital/vienkartine. The version is shown at the bottom of every page. In a copy of that version, run “bun run verify https://secret.areza.digital” to compare this site's JavaScript with its code.
How do I report abuse?
Write to hello@areza.digital with the link, leaving out the part after the # sign. We remove requests used for fraud.
We automate business processes.
Areza Digital builds systems that collect documents, sort email, connect apps and run AI agents.