One-Time Secret Hosting Live In 5 Minutes

One-Time Secret hosting turns passwords and access details into single-reveal links on your own domain, so they stop lingering in email and chat. Deploy One-Time Secret 0.26.8 as self-hosted secret sharing: xCloud runs the pinned image with a private Valkey datastore, generates the root secret and publishes the app over HTTPS in minutes. Anyone can create a link without an account.

Deploy your One-Time Secret

No terminal
No technical skills needed
No lock-in, cancel anytime

What is One-Time Secret?

One-Time Secret, written Onetime Secret by upstream, is a self-hosted secret sharing app. A onetime secret is a link that can be viewed only once: when you send a password by email or chat, copies linger in many places, whereas a one-time link self-destructs after viewing. A self-hosted One-Time Secret is an alternative to emailing passwords or pasting them into chat, with the code under the MIT licence.

On xCloud it is One-Time Secret 0.26.8 from the official image, pinned by digest, with a private Valkey 8.1 datastore on the one_time_secret_valkey volume. xCloud generates the root encryption secret and serves the app over HTTPS on your domain. The template configures no SMTP and creates no admin account, so anonymous link creation is the baseline.

From Sign-Up to a Live One-Time Secret In Just 3 Easy Steps

A secret-sharing service needs an app container, a datastore, an encryption secret, a domain and a certificate before the first link exists. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick One-Time Secret from the OneClick catalog. Choose your domain and server; the install form has no application fields to fill in.
Step 02
We Deploy It For You
One click. We start the One-Time Secret 0.26.8 image and a private Valkey 8.1 service, both pinned by digest, generate the root secret, mount the one_time_secret_valkey volume and publish the app over HTTPS.
Step 03
Create And Reveal A Secret
Open your HTTPS URL, enter synthetic text, choose a short lifetime and create the secret. Open the share link in a private window, reveal it once, then reopen it to confirm the secret is gone.

Everything One-Time Secret Does, On Your Own Server

One-Time Secret runs here as a single-reveal link service with a private datastore, on infrastructure you control.

Single-Reveal Links
Create a link built to stop disclosing its contents after the first reveal, so a password is not left sitting in a mailbox or chat log.
Selectable Lifetime
Choose how long a secret stays available before it expires, which suits temporary access details that should not outlive the moment.
Private Valkey Datastore
Secrets, sessions, accounts and application state sit in Valkey on a private network with no published host port; only the app is reachable.
Root Secret Enforced At Boot
A generated root secret protects stored state, and the boot verifier is set to enforce, so a changed value stops the app starting rather than hiding unreadable data.
Anonymous Creation
Create and share a secret without an account. The core flow needs no SMTP, though email verification and notifications do.
Optional Account Signup
Upstream's simple-auth mode allows account signup. Email verification and notifications need an SMTP server that you configure separately.

Everything You Need To Run Your Secret Sharing 24/7

Managed hosting for One-Time Secret, so the parts that keep it online are not your problem.

One-Time Secret 0.26.8 deployed instantly
Official images pinned by digest
Root secret generated for you
Valkey kept off the public internet
Free SSL certificate
Valkey data on a persistent volume
Server backups and snapshots
30+ server locations
Unused balance refunded

What You Can Do With One-Time Secret

Send a password without leaving a copy
Share a login with a new contractor through a link that reveals once, rather than a message that stays in their inbox and yours.
Hand over access details to a client
Give a client a database or hosting credential on a short lifetime, so it expires on its own if they never open it.
Give a support team a safe channel
Let your support staff ask customers for one-off tokens through a link on your own domain instead of a public secret-sharing site.
Keep sharing links on your own domain
Run the service where your team already trusts the hostname, so colleagues need no third-party site for sensitive text.

One-Time Secret vs Alternatives

Emailing passwords: As an alternative to emailing or chatting passwords, a One-Time Secret link reveals its contents once, so the plain text does not stay in the thread.
PrivateBin: PrivateBin has its own OneClick page. In a One-Time Secret vs PrivateBin comparison, One-Time Secret centres on single-reveal links with a selectable lifetime, while PrivateBin is a pastebin.
Password Pusher: Password Pusher has its own OneClick page. In a One-Time Secret vs Password Pusher comparison, both share sensitive text through expiring links, so compare them against how you plan to run them.
Yopass: Yopass has its own OneClick page. It is another self-hosted tool for sharing secrets that you can compare before you pick one.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for One-Time Secret hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if it shares the server with heavier apps.

59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. One-Time Secret is licensed under MIT.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy One-Time Secret on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Stop Sharing Secrets By Chat Or Email?

One-Time Secret on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. The links, the datastore and the domain are yours.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Can you self-host One-Time Secret with Docker?

Yes. Upstream publishes an official Docker image, and this template is One-Time Secret Docker hosting without the Compose work: the v0.26.8 image and Valkey 8.1, both pinned by digest, one data volume and HTTPS on your domain.

How much RAM does One-Time Secret need?

The manifest floor is 1024 MB of RAM, a single core and 2 GB of disk. The 6 GB plan sits well above that, and the practical disk use depends on how many secrets you store and how long you keep them.

Does One-Time Secret need Redis?

Upstream's quick start uses Redis. This template runs Valkey 8.1 instead, a private datastore on the Compose network with no published port, so you do not install, secure or update a separate database server yourself.

What happens if I lose the One-Time Secret root secret?

Existing secrets become unreadable, and upstream says losing the key is not recoverable. The template generates the root secret at install and enforces it at boot, so keep it with your volume backup from the same installation.

How do I back up One-Time Secret?

Back up the one_time_secret_valkey volume together with the stable root secret from the same installation, then restore both together and test the result with an expendable secret before relying on it. Nothing schedules the copy for you, so run it yourself.

Backup and restore Docker apps

How do I upgrade One-Time Secret?

The install stays on its pinned 0.26.8 image until you adopt a newer template version. Take a tested backup first and read the intervening upstream release notes. Catalog updates reach new installs only, never existing sites.

Is One-Time Secret open source?

Yes. The MIT licence covers One-Time Secret, so the software costs nothing. What you pay for is the Cloud VPS underneath, which turns this into a One-Time Secret cloud of your own rather than a public service.

Does One-Time Secret send email?

No, not in this template. It configures no SMTP, and anonymous secret creation does not need any. Email verification and notifications are upstream features that work only once you supply and configure an SMTP server of your own.

Is there an admin account?

No. The template generates only the root secret and shows only the application URL in the credentials panel. Anyone who can reach the domain can create a secret, so add Basic Authentication if only your team should.

Can I run other apps on the same server?

Yes. One-Time Secret and Valkey are light, so a dedicated Cloud VPS has room for other OneClick apps beside them, each on its own domain, as long as memory and disk remain for all of them.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.