Comparison · verified 1 September 2026

X-TKN vs Onetime Secret

They are a fifteen-year-old human-facing tool with an API attached. We are an API with a human retrieval page attached. If what you want is a web form to paste a password into, theirs is better, and it is free.

Read the API docs See pricing
10K
free ops/month
256-bit
codes, hashed at rest
0
decryption keys we hold
One-time handoff
Retrieval link
x-tkn.com/s/#7f3a9c1e…
one read expires in 24h unread
Encrypted before it left the sender
We hold ciphertext; the key stays in the link
Waiting for the one read…
Where they win

Free, established, and the name people search for

Taking this first because it is the honest order.

  • Their free tier includes a REST API, one custom domain, burn-after-reading, expiry up to 14 days and email delivery. Custom domains are not free here.
  • Fifteen years of operation, and the brand is the search term.
  • A paste-a-password form anyone can use without an account. Ours is in the account console, behind sign-in.
  • Identity Plus at 35 euros a month adds unlimited custom domains and branding; Team Plus at 125 euros adds RBAC, SSO and teams.
Where we differ

Things that are not on their price list at any tier

  • Recipient auth before reveal, by passphrase or an emailed 6-digit code.
  • Retrieval webhooks: read at this time, from this IP.
  • Audit history with per-tier retention, CSV export, and streaming to a webhook or S3 on Enterprise.
  • refId recipient scoping, per-API-key IP allowlists, and per-tenant isolation.
  • Quota position on every metered response, and a 402 refusal an agent can act on.
  • An unauthenticated sandbox key, so you can call the thing before deciding about it.

How to choose

Pick theirs if a person is going to open a web page and paste a password into it. That is the workflow they have spent fifteen years on, their free tier covers it, and ours sits behind a sign-in.

Pick ours if the sender is a script or an agent, or if you need to show afterwards what was read and by whom. Recipient auth, retrieval webhooks and an exportable audit trail are the three we would point at, and none of them appear on their price list.

Verified against onetimesecret.com on 1 September 2026. Pricing pages move. If you find something here out of date, tell us and we will fix it rather than leave it.

No account needed

Get a key without signing up

The sandbox endpoint returns a working key: 100 operations, 24 hours.

Read the API docs Compare with Vaulted