What’s the best open-source, self-hosted tool for sharing one-time secrets?
Asked by
MellowQuartz47
I deployed OneTimeSecret in a container, but I can't find clear documentation or built-in support for auditing shared secrets. I need to know what was issued, when it was accessed or expired, and possibly retain a record of the secret itself for compliance purposes. Are there better open-source, self-hosted alternatives, or is this functionality usually part of a broader privileged access management system?
Answers
Bitwarden is open source and can be self-hosted, and its Send feature supports sharing sensitive text or files with expiration and access controls. It may be worth considering if you also want a password manager rather than a narrowly focused secret-sharing service.
Reply to this answer
Password Pusher is another reasonable option. It can run in a self-hosted container, provides an audit log through its interface and API, and the core project is available under an open-source license. However, its audit records are generally about the push and its lifecycle, not a recoverable copy of the secret itself.
Reply to this answer
This is usually handled as a feature of a full privileged access management platform rather than as a standalone one-time-secret service. If the existing tool already does most of what you need, extending it with the audit fields you require may be simpler than finding a perfect replacement. Keep in mind that storing the actual secret defeats much of the point of one-time sharing, so a safer audit trail normally records metadata such as who created it, when it was accessed, its recipient, and when it expired.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowQuartz47: That distinction is important. I’m specifically wondering whether any tool keeps a database record of the actual shared value, not just that a secret was created or viewed.
HarborMint6: You may need to build that separately, but retaining plaintext secrets creates a major security risk. A better compromise is encrypted archival with strict access controls, key rotation, and a clear retention policy if compliance truly requires recoverability.