Zero-knowledge encrypted, self-destructing secret links from your launcher.
Encrypt a password, API key, or any short piece of text on your machine, get back a one-time link, and share it through any channel — Slack, email, SMS. The recipient opens the link, the secret decrypts in their browser, and it's gone forever. The Vaulted server only ever stores ciphertext; the decryption key lives in the URL fragment, which browsers never transmit.
Form-driven creation. Type or paste up to 1,000 characters, pick a max-view count (1, 3, 5, 10, or unlimited within expiry), pick an expiry (1 hour to 30 days), and optionally add a passphrase that the recipient must enter to decrypt. The share link is copied to your clipboard automatically.
The hotkey path. Bind it to a Raycast shortcut (e.g. ⌥⌘V), copy a secret to the clipboard, fire the command. The clipboard is replaced with a Vaulted share link, your defaults from preferences are used. A HUD confirms the result.
Paste a Vaulted link, optionally enter the passphrase if the link was passphrase-protected, and the plaintext appears in a Detail view. A confirmation prompt warns you before consuming a view (toggleable in preferences).
- Zero-knowledge. All encryption and decryption happen in this extension's local Node sandbox using AES-256-GCM via the
@vaulted/cryptopackage — the same primitives as vaulted.fyi, the CLI, the MCP server, and the official GitHub Action. - No telemetry, no analytics, no third-party scripts. The extension's only network egress is to the host you configure (default:
https://vaulted.fyi). - Nothing persisted on disk. This version writes nothing to LocalStorage. No history, no plaintext, no keys.
- HTTPS-only, with
http://localhostandhttp://127.0.0.1allowed for self-hosted development. - Identifies itself to the server with
User-Agent: vaulted-raycast/<version>and surfaces any server-supplied error message verbatim, so deprecation notices and rate-limit details reach you.
- Vaulted host — Base URL of the Vaulted instance. Default
https://vaulted.fyi. Point at your own deployment for self-hosted use. - Default max views — How many times the link can be viewed before destruction. Default 1.
- Default expiry — How long the link survives if unused. Default 24 hours.
- Open in browser — Open the link in your browser after creation. Default off.
- Confirm before consuming a view — Show a confirmation before revealing a secret in the View command. Default on.
Vaulted is open source and end-to-end encrypted. The server never sees plaintext or the decryption key, even if it's compromised. Read more at vaulted.fyi/security and vaulted.fyi/how-it-works.
This extension: github.com/vaulted-fyi/vaulted-raycast
Related projects:
- vaulted.fyi — the web app
vaulted-cli— terminal client@vaulted/mcp-server— MCP integration for AI agentsshare-secret— GitHub Action
Maxim Novak (@maxim_novak)
MIT