SecretDrop
Encrypted file sharing for devs
SecretDrop is a zero-knowledge secret sharing tool for developers. Files are encrypted in the browser using AES-256-GCM before they ever reach the server.
The server stores only encrypted blobs and can never read your content, filenames, or passwords.
Upload files, set a password, share a link.
No accounts required for recipients.
Free tier available, no credit card needed.
Features
- Client-side encryption using AES-256-GCM with PBKDF2 key derivation (600,000 iterations), built entirely on the Web Crypto API with no third-party crypto libraries
- Zero-knowledge storage — the server never sees plaintext content, filenames, or passwords
- Password-protected shareable links with no recipient account required
- Multi-file bundles — share entire .env files or credential sets in one link
- Expiration policies — time-to-live, download limits, and failed-attempt auto-locking
- Premium mode with public-key encryption (ECIES): no shared password, digital signature verification, only the intended recipient can decrypt
- Access analytics — view counts, download logs, and event history
- Free tier with encrypted password-protected sharing, premium unlocks multiple bundles and advanced policies
Use Cases
- Sharing .env files, API keys, and database credentials with teammates without pasting them into Slack or email
- Onboarding new developers onto a project by securely sending all required secrets in one link
- Freelancers and agencies exchanging client credentials across organizational boundaries
- Sending sensitive config to CI/CD pipelines or staging environments
- Replacing insecure ad-hoc methods (DMs, email attachments, shared docs) with encrypted-by-default sharing that requires zero setup
Fazier Deal
Comments
Hey there, it's Aleks! I run a software development agency. Every week, it's the same story: a client needs to send us database credentials, a freelancer asks for API keys, or we need to hand off config files to a new team member. And every time, someone just pastes it in Slack. Or emails it. Or drops it in a Google Doc called "stuff for dev." We all know it's wrong. But the secure alternatives were always too heavy. Vault setups, CLI tools, enterprise platforms that require everyone to create an account and read a manual first. I wanted something dead simple: upload files, share a link, done. But actually encrypted. Not "we promise we're secure" encrypted — encrypted in the browser before anything touches a server. So I built SecretDrop. It started as a weekend project for my own agency. Password-protected links with client-side AES-256-GCM encryption. No recipient account needed. The server literally cannot read your files. Then I kept running into one more problem: for teammates and long-term collaborators, sharing passwords felt redundant. They already have accounts. Why can't I just send it directly to them? So I built E2E Direct Transfer. Select a recipient by email, files get encrypted with their public key, only they can decrypt. No passwords. No shared secrets. Sender identity verified with digital signatures. The whole thing is built on WebCrypto standards. No third-party crypto libraries. Private keys never leave the browser unencrypted. I built this for myself first. Turns out every developer, freelancer, and agency has the exact same problem. If you've ever pasted a secret somewhere you shouldn't have, this is for you. Checkout SecretDrop, we have a Free Tier available which will already make your workflow more secure or use the Code "FAZ40" to get 40% off. Cheers!
Premium Products
Fazier Deal
Makers
Makers
Comments
Hey there, it's Aleks! I run a software development agency. Every week, it's the same story: a client needs to send us database credentials, a freelancer asks for API keys, or we need to hand off config files to a new team member. And every time, someone just pastes it in Slack. Or emails it. Or drops it in a Google Doc called "stuff for dev." We all know it's wrong. But the secure alternatives were always too heavy. Vault setups, CLI tools, enterprise platforms that require everyone to create an account and read a manual first. I wanted something dead simple: upload files, share a link, done. But actually encrypted. Not "we promise we're secure" encrypted — encrypted in the browser before anything touches a server. So I built SecretDrop. It started as a weekend project for my own agency. Password-protected links with client-side AES-256-GCM encryption. No recipient account needed. The server literally cannot read your files. Then I kept running into one more problem: for teammates and long-term collaborators, sharing passwords felt redundant. They already have accounts. Why can't I just send it directly to them? So I built E2E Direct Transfer. Select a recipient by email, files get encrypted with their public key, only they can decrypt. No passwords. No shared secrets. Sender identity verified with digital signatures. The whole thing is built on WebCrypto standards. No third-party crypto libraries. Private keys never leave the browser unencrypted. I built this for myself first. Turns out every developer, freelancer, and agency has the exact same problem. If you've ever pasted a secret somewhere you shouldn't have, this is for you. Checkout SecretDrop, we have a Free Tier available which will already make your workflow more secure or use the Code "FAZ40" to get 40% off. Cheers!
Premium Products
New to Fazier?
Find your next favorite product or submit your own. Made by @FalakDigital.
Copyright ©2025. All Rights Reserved