Nix – Zero-Knowledge Secret Sharing

TL;DR

TL;DR: Nix encrypts secrets in your browser and serves them as one-time viewable links — the server never holds the decryption key.

Source and Accuracy Notes

• Project page: nix.jaid.dev
• Source repository: github.com/ntempus/nix
• License: MIT (verified via GitHub API license.spdx_id)
• HN launch thread: news.ycombinator.com/item?id=46613782

What Is Nix?

Nix is a self-hostable web app for sharing sensitive data through one-time viewable links. You paste a password, API key, secret message, or upload a small file — Nix encrypts it client-side using the Web Crypto API, generates a unique URL, and destroys the data after the first view.

The product tagline on the site reads: “Share sensitive data securely with one-time viewable links. Encrypted in your browser, ephemeral, and zero-knowledge.”

Key claims verified from source:

• Burn on read — selecting “Instant” expiration permanently deletes the link after the first view
• Zero-knowledge — data is encrypted locally before transmission; the server stores only ciphertext
• Auto-expiration — configurable timers: Instant, 5 minutes, 1 hour, or 24 hours
• Passphrase protection — optional additional encryption layer with a user-set passphrase
• Open-source — MIT-licensed, self-hostable

Setup Workflow

Step 1: Use the Hosted Version

Visit nix.jaid.dev. No sign-up required. Select the Text or File tab, paste your content, configure expiration, and click Create Link.

Step 2: Self-Host with Docker

git clone https://github.com/ntempus/nix.git
cd nix
docker build -t nix-share .
docker run -d -p 3000:3000 --name nix nix-share

Visit http://localhost:3000 to use your own instance.

Step 3: Verify the Security Model

Click How it works in the nav to read the security explainer. The page documents the client-side encryption flow, key exchange (or lack thereof on the server), and what data the server does and does not store.

Deeper Analysis

Nix targets developers and operations teams who need to share credentials, API keys, or sensitive config without using Slack, email, or unencrypted pastebins.

The threat model is straightforward: the server is treated as a passive ciphertext store. Even if the server is compromised, the ciphertext is useless without the per-link key — which lives in the URL fragment (#key) and is never sent to the server.

Contrast with services like Pastebin or GitHub Gist: those store plaintext and log access. Contrast with 1Password’s share link feature: that ties into an existing vault, which may be undesirable for one-off, ephemeral shares.

Self-hosting is the primary differentiator for teams that cannot use third-party paste services due to compliance requirements.

Practical Evaluation Checklist

• Browser-based encryption (Web Crypto API) — no server-side key handling
• One-time link: server deletes ciphertext after first retrieval
• Optional passphrase adds a second encryption layer independent of the link key
• Expiration options cover instant, 5m, 1h, 24h
• MIT license, self-hostable — suitable for on-premises use
• No account or API key required to create links
• Source available at github.com/ntempus/nix

Security Notes

• The link URL contains the decryption key in the fragment (#...). Share it via a separate channel from the link itself — if both land in the same Slack message, anyone with access to that channel can decrypt.
• “Instant” expiration means the server deletes ciphertext on first view; this does not prevent a determined recipient from copying content before closing the tab.
• Self-hosting requires TLS (the repo README recommends a reverse proxy with HTTPS) to prevent plaintext interception in transit.

FAQ

Q: Can I share files larger than text? A: Yes, the File tab supports file uploads. The site UI shows a file input alongside the text area.

Q: What happens if a link is never opened within the expiration window? A: The ciphertext is automatically deleted server-side. The link becomes inert.

Q: Does Nix log who accessed a link? A: By design, no. The server tracks only that a link was created and that it was accessed once before deletion. It does not log IP addresses or viewing identities.

Q: Can I use Nix without an internet connection? A: The hosted version requires internet access. If self-hosted on an intranet, users on the same network can access it offline.

Conclusion

Nix fills a narrow but real gap: one-way, ephemeral, zero-knowledge data sharing without accounts or third-party lock-in. It’s a single-page web app that takes minutes to self-host, uses the browser’s native crypto for client-side encryption, and has a clean HN-blessed MIT codebase. If your team regularly shares credentials or sensitive config, running nix.jaid.dev on a small VPS is a low-friction way to replace Slack-based secret sharing.