One Pass

How to Use One Pass

Sharing a Secret (Sender)

1. Go to the Create Secret tab.
2. Optionally enter a description (e.g., "Production DB password").
3. Paste your secret or password into the text area.
4. Select a link expiry time (1 hour to 7 days). Default is 24 hours.
5. Click Generate One-Time Link.
6. Copy the generated link and send it to the recipient via any channel.

Note: The encryption key is embedded in the URL fragment (#). It is never sent to the server.

Viewing a Secret (Recipient)

1. Click the link you received — the secret loads and decrypts automatically.
2. The secret is displayed once and the link is immediately invalidated.
3. Copy the secret and store it securely (e.g., in a password manager).

Important: If the link has already been opened or has expired, you will see an error message.

Chrome Extension

The One Pass It Chrome extension lets you create secrets directly from selected text on any web page.

Installation

1. Download one-pass-it-extension.zip.
2. Extract the ZIP to a local folder.
3. Open Chrome and navigate to chrome://extensions.
4. Enable Developer mode (toggle in the top-right corner).
5. Click Load unpacked and select the extracted folder.
6. The extension icon appears in your toolbar. Done!

Usage

1. Select any sensitive text on a web page.
2. Right-click and choose One Pass It from the context menu.
3. One Pass opens with the text pre-filled in the secret field.
4. Choose an expiry time and click Generate One-Time Link.

Security Notes

• The selected text is passed via a URL fragment (#prefill=...) — it is never sent to any server.
• The extension does not store or persist any data locally.
• Encryption happens entirely in the browser using the Web Crypto API.
• The extension requires only the contextMenus permission.

CLI (Node.js)

A Node.js CLI that creates one-time secret links using native crypto. Authenticate via the --cookie flag, a cached session, or an interactive browser prompt.

Download

Prerequisites

Requires Node.js 18+. No external packages needed.

How It Works

1. CLI checks for a cookie via --cookie flag, ONEPASS_COOKIE env var, or the local cache (~/.onepass-cli/cookie).
2. If no valid cookie is found, the CLI opens your browser and prompts you to paste the cookie from DevTools (F12 → Application → Cookies → CF_Authorization).
3. The secret is encrypted locally using AES-256-GCM via the Web Crypto API (same as the browser).
4. The encrypted payload is sent to the /api/create endpoint, and the one-time link is printed to stdout.

Usage

node cli/one-pass-cli.js --secret "MyP@ssw0rd"

node cli/one-pass-cli.js --secret "pwd" --description "DB password" --expiry 48

echo "SuperSecret" | node cli/one-pass-cli.js

node cli/one-pass-cli.js --cookie "eyJ..." --secret "pwd"

node cli/one-pass-cli.js --login

node cli/one-pass-cli.js --secret "token" --url "http://localhost:8788" --email "user@roche.com"

Parameters

Email is auto-detected from your SSO session. Use --email to override. Must end with @roche.com, @businesspartner.roche.com, @gene.com, or @external.gene.com

Getting the Cookie

1. Open onepass.roche.com in Chrome and log in via SSO.
2. Press F12 → Application tab → Cookies → select the One Pass origin.
3. Find CF_Authorization → double-click the Value → Ctrl+C to copy.
4. Pass it with --cookie "value" or set ONEPASS_COOKIE environment variable.