Hemmelig

Hemmelig is a self-hosted web application designed for the secure sharing of sensitive information. It utilizes client-side encryption to ensure that data is encrypted in the browser before it is transmitted to the server. Users can create secrets with specific expiration times and view limits, which are then shared via a generated link that automatically deletes the content once the conditions are met.

The software is deployed as a server application, with official support for Docker and Kubernetes via Helm charts. In addition to the web interface, it provides a dedicated command-line interface (CLI) that allows users to create secrets directly from a terminal. This CLI functionality makes the tool suitable for automation and integration into CI/CD pipelines where sensitive credentials must be passed securely.

Key features

• Client-side AES-256-GCM encryption
• Self-destructing messages with configurable expiration and view limits
• Optional password protection for added security
• IP restrictions to limit access to specific ranges
• Encrypted file uploads for authenticated users
• Rich text editor for secret formatting
• QR code generation for mobile sharing
• Webhook notifications for view or burn events

The application follows a zero-knowledge architecture, meaning the server stores only encrypted data and does not have access to the secrets or the encryption keys. For administrators, it includes several operational tools such as Prometheus metrics for monitoring, health checks for container orchestration, and support for social login via OAuth providers like GitHub and Google. The system also supports secret requests, allowing users to securely request sensitive information from others. A REST API and OpenAPI specification are available for developers to generate client SDKs and build custom integrations.

Hemmelig is intended for individuals and organizations that need to transmit passwords, API keys, or personal data while maintaining strict privacy controls and ensuring that sensitive data does not persist on a server longer than necessary.