SecretBolt vs One-Time Secret

Pick SecretBolt if a secret has to reach a script as well as a person: links can allow more than one view, every view lands in a per-secret event log, and the API can hand a .env straight to the shell. Pick One-Time Secret if you need to run it on your own servers, want secret links on your own domain, or need single sign-on for your team — SecretBolt has none of those.

Side by side

	SecretBolt	One-Time Secret
Price	Free: $0, no card required. Pro $9/mo waitlist, Team $29/mo waitlist — not purchasable yet.	Basic: free. Identity Plus $35/mo, Team Plus $125/mo (monthly billing, US prices).
API	REST API on every plan, with read-write or read-only keys.	REST API on every plan, including the free one.
Export to environment variables	Yes. `GET …/export` prints shell-safe `KEY='value'` lines to save to a file, read and load, or to pass to `eval`.	Not listed.
Passphrase on a secret	Yes, optional, on every plan (stored as a bcrypt hash).	Yes, optional.
View and expiry limits	Free: up to 2 views and 24h per secret, 10 active secrets. Pro: 10 views, 7 days waitlist; Team: 50 views, 30 days waitlist.	One view per secret. Expiration up to 14 days on Basic, up to 30 days on paid plans.
Event log	Yes, on every plan: each secret's created, viewed, expired and destroyed events, with IP and User-Agent for views.	Security audit trail on Team Plus, marked beta.
Self-hosting	No — hosted only.	Yes, with Docker or a manual install.
Open source	No.	Yes (MIT).
Custom domains	No.	One custom domain on the free plan, unlimited on Identity Plus and Team Plus.
Single sign-on	No.	Yes, on Team Plus.
Teams	One user per account today. Team management, Advanced audit logs, and Webhook notifications: coming soon on Team waitlist.	Team Plus: organizations with teams, member management and role-based access control.

“Not listed” means we did not find it on the One-Time Secret pages linked at the bottom of this page, not that it cannot be done.

Where SecretBolt is the shorter path

Send a `.env` to a teammate

One request from the directory you are in. Allow one view, share the link in chat and the passphrase over a different channel.

Don't type the passphrase into the command itself: shells save commands in history. read -rs PASSPHRASE asks for it without showing it and keeps it out of history.

read -rs PASSPHRASE   # typed, not echoed, not saved in shell history
curl -fsS -X POST https://secretbolt.io/api/v1/secrets \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile env .env --arg passphrase "$PASSPHRASE" '{
    name: "staging .env", content: $env,
    max_views: 1, expires_in_hours: 24,
    passphrase: $passphrase}')"
# → {"url": ".../s/…", ...}

Hand a secret to CI/CD

A build step with a read-only key saves the values to a private file and loads them into its environment. Each fetch uses up a view, so this suits one-off handoffs such as bootstrapping a new environment, not values a pipeline reads on every run. In a pipeline, drop the cat line: it prints the values into the build log.

# Recommended: write to a private file, read it, then load it
(umask 077 && curl -fsS -o .env.secretbolt \
  -H "Authorization: Bearer $READ_ONLY_KEY" \
  https://secretbolt.io/api/v1/secrets/$TOKEN/export \
  -H "X-Passphrase: $PASSPHRASE")   # leave $PASSPHRASE empty if the secret has none
cat .env.secretbolt          # check what you're about to load
set -a; . ./.env.secretbolt; set +a
rm .env.secretbolt

Shortcut: `eval`

The output is escaped and PATH or LD_PRELOAD are never exported, but eval means trusting every server response without looking at it.

secret_env=$(curl -fsS \
  -H "Authorization: Bearer $READ_ONLY_KEY" \
  https://secretbolt.io/api/v1/secrets/$TOKEN/export \
  -H "X-Passphrase: $PASSPHRASE") &&   # leave $PASSPHRASE empty if the secret has none
  eval "$secret_env"

Send a password to a client

Your client needs no account, only the link. An unopened link expires on its own, and the passphrase you tell them on the phone never travels with it.

read -rs CLIENT_PASSWORD   # the client's password, kept out of shell history too
curl -fsS -X POST https://secretbolt.io/api/v1/secrets \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg content "$CLIENT_PASSWORD" --arg passphrase "$PASSPHRASE" '{
    name: "Acme admin login",
    content: $content,
    passphrase: $passphrase,
    max_views: 1, expires_in_hours: 24}')"

Full request and response formats are in the API docs.

Try it on your next handoff

The Free plan has the API, export, passphrases and the event log. Pro and Team are not on sale yet — join the waitlist and we will email you when they open.

Get started free Join the Pro / Team waitlist

Competitor details checked on October 13, 2026. Sources: