Stop pasting
.env files
in Slack
A CLI that encrypts your secrets, generates a self-destructing link, and shares it in 3 seconds. The server never sees your keys.
No signup. No credit card. Works in 5 seconds.
From install to self-destruct,
in half a minute.
Two machines, one link. Every line of output was captured from the real CLI running against a real server — nothing here is a mockup.
Three commands.
Zero friction.
The receiver doesn't even need the CLI — they can open the link in a browser. That's the point.
Push your .env
kip encrypts your file locally with a unique random key. That key never touches our server.
Share the link
The decryption key lives in the URL #fragment — browsers never send that to servers. It's an HTTP protocol guarantee.
It self-destructs
After the configured reads, the encrypted blob is permanently deleted. TTL ensures deletion even if nobody reads it.
Even if we're hacked,
attackers get garbage
The server stores only encrypted blobs. The decryption key lives exclusively in your URL fragment — which browsers never transmit over HTTP. It's not a policy. It's cryptographic fact.
Everything you need.
Nothing you don't.
We do one thing — ephemeral secret sharing — and we do it correctly.
AES-256-GCM encryption
Authenticated encryption. Tampered ciphertext is rejected, not silently corrupted.
Self-destructing links
Configure TTL and max reads independently. Links die after use — Redis TTL guarantees it.
Lightweight teams
Teams work like game lobbies. Create, share an invite code, done. No admin panels, no RBAC.
Web decrypt page
Receivers don't need the CLI. Open the link in a browser — decryption happens client-side.
Secret scanning
Offline regex patterns flag AWS and Stripe keys, GitHub tokens and weak secrets before you share.
Self-host in 30 seconds
Docker Compose. Server + Redis + SQLite in one file. No cloud lock-in. Free forever.
The only tool that does
all of this at once.
| Feature | kip | Slack DM | Yopass | Doppler |
|---|---|---|---|---|
| Native CLI | YES | NO | NO | YES |
| Zero-knowledge encryption | YES | NO | PARTIAL | NO |
| Self-destructing links | YES | NO | YES | NO |
| Self-hostable (free) | YES | NO | YES | NO |
| Receiver needs account | NO | NO | NO | YES |
| Lightweight teams | YES | YES | NO | YES |
| Secret scanning | YES | NO | NO | PARTIAL |
| Starts at | FREE | FREE | FREE | $21/user/mo |
Your infra.
Your data.
Zero ops.
One Docker Compose file brings up the Go server, Redis, and an SQLite volume. It runs anywhere — your VPS, Fly.io, Railway, whatever.
Straight answers.
No marketing copy.
What happens if the server is compromised? +
Does the receiver need to install anything? +
What does it cost? +
Can I self-host for my company? +
How do teams work? +
What does the secret scan actually do? +
Ship it.
Don't Slack it.
Install takes 5 seconds. First share takes 3 more.
Also: go install github.com/kipenv/kip/cmd/kip@latest · self-host guide