sup3rS3cretMes5age Hosting Live In 5 Minutes

sup3rS3cretMes5age hosting on xCloud gives you a self-hosted one-time secret sharing service on your own domain. Deploy sup3rS3cretMes5age in one click and xCloud brings up the pinned app, a private HashiCorp Vault backend reachable only over the install's private network, a generated Vault token and HTTPS. Paste a message or attach a file, choose an expiry and send a link that works once.

Deploy your sup3rS3cretMes5age

No terminal
No technical skills needed
No lock-in, cancel anytime

What is sup3rS3cretMes5age?

Self-hosted sup3rS3cretMes5age is a simple, self-destructing message service published by Algolia that uses HashiCorp Vault as a backend for temporary secret storage. Messages sit in Vault's cubbyhole behind one-time tokens and are deleted after the first read, and files up to 50 MB are supported. It does the job of Onetime Secret on your own server. It is written in Go and licensed under MIT.

On xCloud the template runs the algolia/supersecretmessage 0.4.4 image and a private HashiCorp Vault 1.21.4 container, both pinned by immutable digest, exposed through xCloud's nginx with HTTPS on your domain. xCloud generates the Vault token and never publishes Vault's port. Vault runs in dev mode with in-memory storage, so there is no volume and a restart or redeploy destroys every unread secret. The app has no accounts: anyone who can reach the site can create a secret.

From Sign-Up to a Live sup3rS3cretMes5age Link In Just 3 Easy Steps

Self-hosting sup3rS3cretMes5age normally means two containers, a private network between them, a domain and a certificate before a single secret ships. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account, pick sup3rS3cretMes5age from the OneClick catalog and choose a domain. There are no fields to fill in — xCloud generates a unique Vault token.
Step 02
We Deploy It For You
One click. We bring up the app pinned by immutable digest alongside a private HashiCorp Vault 1.21.4 service with no public port, and publish the app over HTTPS.
Step 03
Paste A Secret And Share The Link
Open your HTTPS URL (allow about a minute on first boot), paste a message or attach a file up to 50 MiB, choose an expiry, and copy the one-time link to send.

Everything sup3rS3cretMes5age Does, On Your Own Server

sup3rS3cretMes5age runs in full here — the same one-time secret and file sharing as any hosted alternative, on infrastructure you control.

Self-Destructing One-Time Reads
A secret works exactly once. Opening the link a second time shows it is already deleted.
Files Up To 50 MiB
Attach files alongside a message — certificates, key files or config bundles — with the same one-time-read rule.
Choose Your Expiry
Set an expiry anywhere from one minute to seven days when you create the link. An unread secret is deleted when it expires.
Private Vault Cubbyhole
Secrets are stored in a private HashiCorp Vault cubbyhole behind one-time tokens, with no external CDNs or tracking in the page.
No Accounts To Manage
Paste, create the link, send it — there is no sign-in step for the person creating a secret.
Built-In Rate Limiting
Per-IP rate limiting protects the API from being hammered by automated requests.

Everything You Need To Run Your Secret Sharing 24/7

Managed hosting for sup3rS3cretMes5age, so the parts that keep it online are not your problem.

sup3rS3cretMes5age 0.4.4 deployed instantly
Private HashiCorp Vault backend
Unique Vault token generated for you
Free SSL certificate
Built-in per-IP rate limiting
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With sup3rS3cretMes5age

Run a self-destructing message service
Give your team one address for passing passwords, API keys and recovery codes. Each link works once and an unread secret expires, so the value is not left sitting in a chat history.
Share a key file or certificate
Attach a certificate, key file or config bundle up to 50 MiB and send the one-time link to a contractor. The same read-once rule applies to files as to text messages.
Set a short expiry per secret
Choose any expiry from one minute to seven days when you create the link; upstream's default is 48 hours. A code for a call in ten minutes can expire before the call ends.
Keep the creator page internal
The app has no login, so the template leaves the site open. Add Basic Auth or an IP allowlist at the reverse proxy yourself if only your team should create secrets.

sup3rS3cretMes5age vs Alternatives

Onetime Secret: Compared with a hosted one-time link service like Onetime Secret, here the secret lives in a Vault on your own server, is read once, expires within seven days at most, and no third party holds it.
Privnote: Instead of a hosted note service such as Privnote, sup3rS3cretMes5age gives you read-once links on infrastructure you control, with file sharing up to 50 MiB, with expiry set by whoever creates the link.
Password Pusher: Weighing Password Pusher, also available on xCloud? sup3rS3cretMes5age is built around HashiCorp Vault's cubbyhole and one-time tokens, which this template runs as a private container.
Hemmelig: Comparing Hemmelig, also on xCloud? This sup3rS3cretMes5age template stores secrets only in Vault memory: nothing is written to disk, which is also why a restart destroys unread secrets.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for sup3rS3cretMes5age hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More memory headroom for many unread secrets and files held in Vault.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Cloud VPS 24 GB

sup3rS3cretMes5age alongside a whole self-hosted stack.

$84.99per month

24 GB RAM
8 vCPU cores
300 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. sup3rS3cretMes5age itself is free under the MIT licence.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy sup3rS3cretMes5age on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Own Your Secret Sharing?

sup3rS3cretMes5age on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own your secrets. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

How does sup3rS3cretMes5age use HashiCorp Vault?

Secrets are stored in Vault's cubbyhole backend behind one-time tokens that allow exactly two uses, one to create and one to retrieve. This template runs Vault 1.21.4 as a private container whose port 8200 is never published, reachable only from the app.

What happens after a secret is read?

The first successful read deletes it, and opening the same link again shows it is gone. An unread secret is deleted when its expiry passes, which you can set from one minute to seven days when you create the link.

Is sup3rS3cretMes5age free?

Yes. sup3rS3cretMes5age is MIT licensed, so the software costs nothing. The bundled HashiCorp Vault image is distributed under the Business Source License 1.1, so review its terms for your use. xCloud's charge is the dedicated Cloud VPS and its management.

How do I self-host sup3rS3cretMes5age with Docker?

This template does it for you. sup3rS3cretMes5age Docker hosting here means the app and a private Vault container, both pinned by digest, a generated Vault token and HTTPS on your domain, with no compose file, private network or reverse proxy to write yourself.

Can sup3rS3cretMes5age share files?

Yes. You can attach a file up to 50 MiB to a link, and it follows the same read-once rule as a message. Text messages are limited to 1 MiB, and the app's 10-second upload timeout can trip on very large files over slow connections.

Do I need to run Vault myself?

No. The template starts a private HashiCorp Vault container next to the app, with the generated token shared between them and no published port. The app starts only after Vault reports healthy, so allow about a minute after install before the first secret.

Do secrets survive a restart?

No. Vault runs in dev mode with in-memory storage, so restarting, redeploying or stopping the site destroys every unread secret. That suits short-lived one-time links, but do not treat sup3rS3cretMes5age as durable storage for anything you still need.

How do I update sup3rS3cretMes5age?

xCloud does not upgrade the app for you, since both images keep the digests chosen at install and a catalog re-sync only reaches new installations. Updating means changing the pinned digests deliberately and redeploying, which also clears every unread secret, so send or expire links first.

Is there anything to back up?

No, and that is by design: there is no volume and no backup of secret content, because Vault keeps them in memory only. What is worth keeping is the site's environment, which carries the generated Vault token. The app stores no other user data.

What are the server requirements for sup3rS3cretMes5age cloud hosting?

The manifest asks for 512 MB of RAM, one CPU core and 2 GB of disk, with a per-IP limit of 5 requests per second. sup3rS3cretMes5age cloud hosting on xCloud starts at the 6 GB Cloud VPS, which leaves headroom for Vault and the app.

Is xCloud officially partnered with Algolia or HashiCorp?

No. xCloud has no verified agreement with Algolia, HashiCorp or the sup3rS3cretMes5age project and runs the software independently. xCloud simply runs the app and its bundled Vault image for you on a server you rent.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.