hushshare

Share secrets securely from the terminal. End-to-end encrypted, ephemeral, zero-knowledge.

Secrets are encrypted in your terminal before being sent to the server. The server never sees your plaintext or passphrase.

Install

npm install -g hushshare

Or use directly with npx:

npx hushshare "my-secret"

Usage

# Share a secret
hush "db-password-123"

# Pipe from stdin
echo "SECRET=abc123" | hush

# Share a file's contents
hush --file .env

# Custom TTL and read count
hush "API_KEY=sk-abc123" --ttl 30 --reads 3

# Copy link to clipboard
hush "quick-secret" --copy

# Combine options
cat config.yaml | hush --ttl 60 --reads 5 --copy

Options

| Option | Description | Default | |--------|-------------|---------| | --ttl <minutes> | Time to live before auto-destroy | 5 | | --reads <count> | Max reads before auto-destroy | 1 | | --file <path> | Read secret from a file | - | | --copy | Copy link to clipboard | false | | --url <url> | Custom server URL | https://hushshare.dev | | -h, --help | Show help | - | | -V, --version | Show version | - |

Environment Variables

| Variable | Description | |----------|-------------| | HUSHSHARE_URL | Override the default server URL |

How It Works

1. Your secret is encrypted locally using AES-256-GCM with a random passphrase
2. The encrypted payload is sent to the server
3. You get a link with the passphrase in the URL fragment (#)
4. The fragment never leaves your machine — it's not sent to the server
5. The recipient opens the link, decryption happens in their browser
6. The secret self-destructs after the TTL expires or max reads are reached

Self-Hosting

Point the CLI to your own HushShare instance:

hush "my-secret" --url https://my-hushshare.example.com

# Or set it permanently
export HUSHSHARE_URL=https://my-hushshare.example.com
hush "my-secret"

License

MIT