Custom Web Application

Secure Password Sharing

A clearer way to share a secret.

A redesigned secret-sharing tool for Miles Beckler, with a clearer interface, optional password protection, and one-time links.

Secure Password Sharing pastel browser mockup using project imagery — Secure Password Sharing · Miles Beckler

Client: Miles Beckler
My role: Design · Development
Delivery: One-time secret sharing
Tools: PHP · JavaScript

The challenge

Miles already had a password-sharing tool at /locker. He wanted a cleaner experience for sharing confidential information, with reliable password protection, expiration settings, and one-time viewing.

The solution

Locker v2 modernizes the existing utility with a responsive two-column interface, clearer form sections, and understandable success and unavailable-link states. The workflow stays simple: create a secret, share the link, and open it once.

Design, development, and a careful rollout.

Interface redesign

Improved visual hierarchy, form controls, link generation, and recipient-facing password and status screens.

Functional improvements

Connected JavaScript and PHP endpoints, resolving duplicated elements, persistent loading states, broken JavaScript, and inconsistent one-time viewing behavior.

Production migration

Developed and tested under /locker-v2, created server-side backups, updated application paths, and deployed to /locker with rollback copies retained.

PHPJavaScriptWeb Crypto APIHTML / CSSCloudflare

Create. Share. Open.

Create
Enter a secret, optionally add a password, and select an expiration period. The default changed from 24 hours to seven days.
Share
Generate and copy a unique link. When password protection is used, share the password separately from the link.
Open
The recipient unlocks the secret if required. A successful opening shows the message and confirms the link cannot be reused. Unavailable links receive a clear explanation.

The original locker.

The existing utility before the Locker v2 redesign.

The redesigned experience.

From creating a link to opening a secret and handling a link that is no longer available. Select any screenshot to enlarge it.

Create a secure link

Locker v2 — redesigned desktop interface

Create & share

Create form — optional password and expiration settings

Link copied — confirmation after copying the share link

Opening & unavailable states

First opening view of a password-protected secret, with an empty password field and Unlock Secret button — First opening view — password required before revealing the secret

Secret opened — confirmation that the link cannot be reused

Unavailable link — expired or already viewed

A polished replacement for the original tool.

Locker v2 was deployed to /locker, with the production homepage returning HTTP 200. Project testing confirmed that password-protected secrets could be opened and a consumed link could not be reopened.

iPad testing also surfaced a browser password-autofill issue, and a mitigation was prepared.

“Love it... it's much nicer than the old one!”

Miles Beckler

View technical detailsSecurity features, project testing, and the limits of the available evidence

The evidence below reflects the project record and functional testing. A complete cryptographic audit was not documented.

Locker v2 security features and validation
Feature	Evidence and limits
Browser-side encryption	The application was described as encrypting in the browser, and its JavaScript/PHP workflow was tested. A complete cryptographic code audit was not documented.
Optional password protection	Password-protected secrets were created and unlocked successfully in testing.
Expiration	Seven days became the default and maximum TTL in the inspected configuration. Automatic expiration at the deadline was not independently verified.
One-time viewing	A secret was opened, and subsequent retrieval returned an unavailable response. Concurrent access behavior was not tested.
Secret deletion	The retrieval workflow made the secret unavailable after opening. Physical deletion from persistent storage or backups was not independently confirmed.

Have a similar project in mind?

Discuss your project