Btwinus vs OneTimeSecret: which one should you use to share a secret?

Both tools exist because "just DM it to me" leaves a copy of the secret in Slack, in email, in two phones, and in whatever cloud backs those up. They agree on the problem and disagree on the fix. OneTimeSecret says: store it briefly, encrypted, then destroy it. Btwinus says: don't store it at all.

What OneTimeSecret is

OneTimeSecret (often written OTS) is a web app. You paste a secret, optionally add a passphrase and an expiry, and get a single-use link. The first person to open the link sees the secret; the server then purges it. No account is required for the basic flow. The hosted service lets you pick the region where your secret sits, Canada, the EU, New Zealand, the UK or the US, which matters if you have data-residency rules.

It's open source under the MIT licence (Ruby backend, Redis for storage), with a Docker image and documentation for self-hosting behind your own reverse proxy. That's the feature that sets it apart from most one-shot note sites: you can put it inside your own network and the secret never leaves your infrastructure.

The encryption model is server-side. The secret is encrypted on the server with a per-secret key; OTS says decryption keys live on the application server and never in the database, and adding your own passphrase adds a second layer the server needs before it can decrypt. What that means in plain terms: with a plain link, the operator of the OTS instance could technically read a secret while it's stored. That's fine if the operator is you. It's a trust question if it's someone else. With a passphrase, the operator can't read it without that passphrase.

The hosted service is free for individuals. Paid tiers (Identity Plus and Team Plus at the time of writing) add custom domains, branding, SSO and team management. We didn't find file uploads documented on any tier, it's a text secret tool.

What Btwinus is

Btwinus is a live one-to-one chat with no backend. Clicking "Start a new chat" produces an invite link and a passphrase. The link's URL fragment carries a WebRTC offer encrypted with AES-256-GCM, the key derived from the passphrase via PBKDF2 (100,000 iterations). You send the link one way and the passphrase another way. The recipient opens the link, enters the passphrase, and sends back a reply link; you paste it and both browsers connect directly. Messages then go browser to browser over WebRTC. Close a tab and the conversation is gone, not deleted, simply never written anywhere.

A short authentication string on both screens lets you confirm out loud that nobody intercepted the handshake. It's free, open source, and because it's a static page, "self-hosting" means copying the files to any web host. (More on how the link carries the encryption.)

The trade-offs: both people must be online at the same moment, it's two people only, and it's text only.

The honest comparison table

Property	OneTimeSecret	Btwinus
Shape	One-shot secret link	Live chat
Account required	None for basic use	None
Where the secret lives	Server (Redis), encrypted, until viewed or expired	Nowhere, browser to browser
Who could read it in storage	Server operator, unless you add a passphrase	Nobody, nothing is stored
Encryption	Server-side, per-secret key, optional passphrase	Client-side AES-256-GCM, PBKDF2 passphrase
Recipient can be offline	Yes	No, both online at once
Two-way conversation	No (paid tier has "incoming secrets")	Yes
Groups	No	No
Files	Not documented	Text only
Open source	Yes (MIT)	Yes
Self-hostable	Yes (Docker, Redis)	Yes (static files)
Data residency	Choose region, or self-host	Not applicable, no data at rest
Cost	Free tier; paid plans for teams	Free

Where OneTimeSecret is the better choice

The recipient isn't online. Hand-offs across time zones, "read this when you start your shift", a credential for a contractor who'll log in tomorrow. OTS holds the secret until they get to it. Btwinus can't; it needs both of you there.

You want it inside your own infrastructure. A self-hosted OTS behind your VPN, with your own logs and your own retention rules, is a genuinely strong setup for a company. Btwinus can be self-hosted too, but there's nothing to log and nothing to audit after the fact, which some compliance teams consider a bug, not a feature.

You need team features. Custom domains, SSO, an API to generate links from scripts, a branded "send me a secret" page. OTS has these. Btwinus has a link and a passphrase.

Simplicity for the receiver. One click, read, done. Btwinus asks the recipient to open a link, type a passphrase, and send a reply link back. It's a small dance, but it is a dance.

Where Btwinus is the better choice

You don't want to trust an operator. On the hosted OTS, a plain link is readable by the operator while it's stored, by design. Btwinus never uploads anything, so the question doesn't arise.

One leaked channel must not be enough. A plain OTS link is the whole secret until it's opened. Btwinus always splits it: the link is useless without the passphrase, and the passphrase goes through a different channel. (OTS can do this too, if you remember to set a passphrase and send it separately, Btwinus just doesn't let you skip it. See how to share a password without leaving a copy behind.)

It's a conversation, not a drop. "Which account?, the deploy one, password is X, and rotate it after" is three messages and a reply. That's a chat.

You want to verify the other end. Btwinus's short authentication string is compared out loud. OTS has no equivalent: the first person to open the link wins.

Nothing to maintain. Running OTS means Redis, updates, TLS, and a backup of the master secret. Btwinus is a static page on a static host.

How to decide

• Recipient offline, or you need an audit trail → OneTimeSecret, ideally self-hosted, always with a passphrase sent separately.
• Recipient available now and you'd rather nothing touch a server → Btwinus.
• Company-wide tool with SSO and an API → OneTimeSecret.
• One-off with someone outside your company, no infrastructure → Btwinus.
• Files or groups → neither; use Signal or a shared vault.

These two aren't really rivals. OneTimeSecret is the right answer when a secret has to wait somewhere safe. Btwinus is the right answer when it doesn't have to wait at all.