Self-host FlashPaper
v2.6.0One-time encrypted secret sharing with zero-knowledge
- Stars
- 522
- Requires
- PHP, Web server (nginx/Apache)
ghcr.io/andrewpaglusch/flashpaperWhat is FlashPaper?
FlashPaper is a self-hosted web application for securely sharing passwords and other secrets through one-time links. When a user submits a secret, it is encrypted with AES-256-CBC using a unique key that is only included in the retrieval URL. The secret is stored in a local SQLite database and automatically deleted after being viewed once or after a configurable retention period. The project provides a Docker image on ghcr.io, a docker-compose.yml for easy deployment, and a traditional PHP installation method requiring PHP 7.0 or newer with a web server. It includes a simple API for programmatic secret submission returning JSON, customizable UI messages and branding, and automatic pruning of old secrets. No user authentication system exists — it is designed for anonymous, ephemeral secret sharing.
Should you self-host FlashPaper?
FlashPaper scores 48/100 on selfhost.directory (how scoring works) and ranks #13 of 28 in Password Managers. It has 522 GitHub stars.
It shipped 2 stable releases in the past year. The latest, v2.6.0, came out on 22 October 2026. New versions land roughly every 4 months.
Setup is easy: most people get it running in one sitting. An official Docker image is available. It is MIT-licensed and written mostly in PHP.
Its closest alternative on selfhost.directory is Vaultwarden (89/100, 69 828 stars). It scores higher overall, so compare the two before you pick. See FlashPaper vs Vaultwarden side by side.
Features
- Automatic secret expiration
- Custom Branding
- Customizable UI messages
- No database server required
- One-time secret sharing
- REST API for secret submission
- Zero-Knowledge Encryption
FlashPaper README
More in Password Managers
FyxxVaultSelf-hosted, open-source password manager with AES-256-GCM encryption, TOTP/2FA, dark web monitoring via HIBP, and zero-knowledge architecture.
guptSelf-hosted, end-to-end encrypted messenger and privacy suite with no phone number or central server — runs in the browser on a decentralized Nostr relay network.
KeewebFree cross-platform password manager compatible with KeePass
keyperKeyper is a self-hosted, open-source credential manager encrypting secrets client-side with AES-256-GCM and Argon2id, storing them in your own database.
keyshadeOpen-source, self-hostable secret management with public key encryption, live updates, versioning, and RBAC.
kontojKontoj is a self-hosted, open-source web app that helps create and manage service accounts using a JSON config file, with autofill via a browser userscript.
lazywardenAutomatic Bitwarden Backup
onetimesecretSelf-hosted, open-source secret sharing service creating one-time links for passwords and API keys, forked from onetimesecret.com with no accounts or paid features.
PadlocOpen-source, end-to-end encrypted password manager with shared vaults, MFA, a built-in authenticator and encrypted file storage; self-hosted via Docker Compose or Node.
PassboltPassbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
Passky-ServerPassky Server is a self-hosted, open-source password manager backend with zero-knowledge encryption using XChaCha20 and Argon2id, free tier up to 100 passwords.
passwd-pageSelf-hosted, open-source zero-knowledge secret sharing tool with burn-after-read, file sharing, CLI, and MCP server for AI agents.
0 comments