Gone

Open source · Self-hosted · Zero-knowledge

Share a secret exactly once.

Encrypted in your browser. Deleted after one read. Gone is a small, open-source tool for handing over a password, a token or a key, from your browser or your terminal, on a server you run yourself.

Install the gone CLI

Linux & macOS

curl -fsSL https://getgone.dev/install.sh | sh

Installs into ~/.local/bin without sudo, after checking the download against the release's checksums. Read the script first

Windows

Download for Windows

Unzip it and put gone.exe somewhere on your PATH. An Arm build is on the release page. All downloads for v3.12.0

From source

go install github.com/haukened/gone/v3/cmd/gone@latest

Needs Go 1.27 or later.

Every install option, and how to verify a download

Just need to send a secret? Use Gone in your browser at app.getgone.dev. No install, no account.Open app.getgone.dev

Only they can read it

Your browser encrypts the secret before it leaves your device, and the key never reaches the server. Not the server, not its operator, not us.

It opens once

The first person to open the link sees the secret. Anyone after them finds nothing.

Then nothing is kept

No copy, no history, and no record that it was ever opened.

How it works

  1. You write the secret. Your browser, or the gone CLI, encrypts it with a new random key using AES-256-GCM.
  2. You send the link. The key is in the part after the #, which browsers never send to a server. The server only ever holds ciphertext.
  3. They open it, once. Their browser downloads the ciphertext, decrypts it, and confirms it arrived. Only then does the server delete it. Unopened secrets expire.
Gone's Open page, the secret waiting behind frosted glass until the recipient presses Open

From your terminal

The gone CLI works with secrets sent from the browser, and the other way round. Messages come from standard input, never from arguments, and scripts and AI agents can handle secrets by reference so the plaintext never appears in their output.

  • printf 'hunter2' | gone send --ttl 30m
    prints the link, and a manage link to revoke it
  • gone get 'https://app.getgone.dev/secret/AbC#v1:…'
    opens a link, once
  • gone request --label 'VPN key'
    asks someone for a secret
  • printf 'hunter2' | gone reply '<request-link>'
    answers someone's request

The CLI guide

Small, with what you need

  • Files

    Up to ten files per secret, encrypted like the message.

  • A passphrase

    A second lock, typed or five generated words, sent separately.

  • Ask for a secret

    Send a link; the reply is encrypted to a key that never leaves your browser.

  • A QR code

    For handing a link over in person.

  • Covered until shown

    An opened secret stays hidden on a shared screen until you press Show.

  • A CLI that fits in

    Works with browser links in both directions, and with scripts.

  • Five languages

    English, Spanish, French, German and Brazilian Portuguese.

  • Operator controls

    Require a passphrase, limit files, add your name and logo, or require sign-in through your own proxy. All free.

  • Metrics

    Prometheus metrics on their own listener, behind a token.

Run your own server

One static binary, one SQLite file, no external services. Every feature is free on every instance.

Built in the open

  • Open sourceEvery line, under the AGPL-3.0 licence.
  • Signed releasesEvery download carries build provenance you can verify.
  • ScoredSecurity practices checked by the OpenSSF Scorecard.

How Gone keeps its promises