OTS (ots.fyi) review 2026: free, open-source, self-hosted one-time secret sharing with browser-side AES-256 encryption. Features, setup and alternatives.
OTS, or One Time Secrets, is a free, open-source tool for sharing sensitive text and files as self-destructing, one-time-use links. The public demo instance runs at ots.fyi, and the underlying project is developed and maintained by independent open-source developer Luzifer under the Apache 2.0 license.
Unlike commercial secret-sharing products, OTS has no company or funding behind it; it is a lightweight, community-maintained tool intended to be self-hosted by individuals, development teams, or IT departments who want full control over how sensitive text is shared and stored.
OTS encrypts secrets with symmetric 256-bit AES encryption directly in the browser before the data is ever sent to the server, and the decryption password lives only in the URL fragment, which browsers do not transmit to the server. This means the server only ever stores and handles ciphertext.
Secrets are permanently deleted immediately after their first read, preventing later retrieval even by someone with direct server access. A companion command-line interface allows scripted creation and retrieval of secrets with configurable expiry times and file attachments, and the project supports both in-memory and Redis storage backends for self-hosted deployments.
OTS is entirely free and open source, with no company, subscription plans, or paid tiers behind it. Self-hosters only bear the cost of running their own server or container, such as via the official Docker image.
The public ots.fyi instance is also free to use directly for occasional secret sharing without any registration or account, making it accessible without self-hosting for lighter use cases.
Yes, OTS is completely free and open source. The public demo at ots.fyi can be used directly at no cost, and the underlying software can be self-hosted for free as well.
OTS is developed and maintained by an independent open-source developer known as Luzifer, with the source code hosted on GitHub under the Apache 2.0 license, rather than by a commercial company.
OTS encrypts secrets with symmetric 256-bit AES encryption directly in the browser before sending them to the server, and the decryption password is embedded only in the URL fragment, which is never transmitted to the server, so the server only handles ciphertext.
The secret is immediately and permanently deleted from storage after its first successful read, preventing it from being retrieved again.
Yes, OTS is distributed as a Docker image and standalone binaries, with support for in-memory or Redis storage backends, making it straightforward to self-host on your own infrastructure.
Yes, OTS includes a command-line interface for creating and retrieving secrets programmatically, with support for configurable expiry times and file attachments.
Alternatives include Onetime Secret, PrivateBin, and Yopass, all of which offer similar self-hosted or hosted one-time secret sharing with client-side encryption.