Short answer: pipe the secret into npx -y evergist create --views 1 --expires 1h. The command encrypts on your machine, uploads ciphertext, and prints a link that opens once. It needs Node.js 20 or newer and nothing else, and the secret never has to appear in your shell history.
How do I share a secret from the terminal without a browser?
Give create a file or pipe text into it. It prints a link, and the person on the other end opens the link in a browser or reads it with the same CLI.
# From a file
npx -y evergist create deploy-key.pem --views 1 --expires 1h
# From stdin
./print-token.sh | npx -y evergist create --views 1 --expires 1h
npx -y downloads the evergist package on first use and runs it. The output looks like this:
https://evergist.com/g/K61kFEBcg76B#<key>
expires: 2026-09-30T10:07:18.810Z
views: 1
delete token: <token>
The part after # is the 256-bit key. It stays on your machine and in the link. Our server gets the ciphertext and a hash of an access token, and can't decrypt either. The full scheme is in how the encryption works.
The flags for create:
| Flag | Meaning |
|---|---|
-e, --expires <time> |
10m, 1h, 1d, 7d, 30d, or a number of seconds. Default 1d, max 30d |
-v, --views <n> |
Delete after this many reads, 1 to 1000. Default is no limit until expiry |
-p, --password <password> |
Require a password as well as the link. EVERGIST_PASSWORD does the same |
-g, --generate-password |
Generate a password and print it next to the link |
--json |
Print JSON |
A note holds up to 512 KiB of UTF-8 text. It's text only, so base64 a binary file first.
How do I keep the secret out of shell history?
Never type the value. Your shell saves the commands you type, so echo "hunter2" | npx -y evergist create leaves hunter2 in the history file. Pipe from something that already holds the secret.
From the clipboard:
# macOS
pbpaste | npx -y evergist create --views 1 --expires 1h
# Linux, Wayland
wl-paste | npx -y evergist create --views 1 --expires 1h
# Linux, X11
xclip -selection clipboard -o | npx -y evergist create --views 1 --expires 1h
From a password generator, when you're setting a new credential and handing it over in one go:
pw=$(npx -y evergist password)
# set $pw wherever it belongs, then:
printf '%s' "$pw" | npx -y evergist create --views 1 --expires 1h
unset pw
evergist password prints a generated password. openssl rand -base64 24 or your own generator works the same way. printf '%s' matters because the note stores exactly the bytes it receives, and echo adds a newline the recipient may paste into a login form.
The same rule applies to --password. A password typed after -p lands in history and in the process list. Use -g to have the CLI generate one, or read it into the environment without echo:
read -rs EVERGIST_PASSWORD && export EVERGIST_PASSWORD
npx -y evergist read "https://evergist.com/g/<id>#<key>"
Send the password through a different channel than the link.
How do I use it in a script?
Add --json and read the fields you need.
printf '%s' "$TOKEN" | npx -y evergist create --views 1 --expires 1h --json
{
"id": "K61kFEBcg76B",
"url": "https://evergist.com/g/K61kFEBcg76B#<key>",
"expiresAt": "2026-09-30T10:07:18.810Z",
"maxViews": 1,
"deleteToken": "<token>",
"passwordProtected": false
}
With -g the JSON also has password. To pull out the link with jq:
link=$(printf '%s' "$TOKEN" | npx -y evergist create --views 1 --expires 1h --json | jq -r .url)
The CLI exits non-zero and writes evergist: <reason> to stderr on any failure, so a script can stop on a failed create. In a pipeline like the one above, the shell reports the exit status of jq, the last command, so use set -euo pipefail in Bash to make the failed create fail the pipeline. Send a secret from CI to a person builds a full GitHub Actions step on top of this.
How do I check whether a note was read, or take it back?
status shows expiry and views left without using a view. delete removes the note.
npx -y evergist status "https://evergist.com/g/<id>#<key>"
expires: 2026-09-30T10:07:18.810Z
views: 1 of 1 left
password: no
Once a one-view note has been read, the same command exits 1:
evergist: Gist not found. It expired, reached its view limit, was deleted, or the link key is wrong.
A script can poll that to see whether the note is still there. "Not found" doesn't prove the recipient read it. It can also mean the note expired, someone deleted it, ten wrong passwords wiped it, or the link is wrong. status --json returns viewsRemaining, maxViews, expiresAt, and password.
To delete a note you sent by mistake:
# With the link
npx -y evergist delete "https://evergist.com/g/<id>#<key>"
# With the id and the delete token from create
npx -y evergist delete K61kFEBcg76B --token "$DELETE_TOKEN"
Keep the delete token to yourself. It deletes the note without the link.
How does the recipient read it?
In a browser, or with read, which prints the text to stdout and uses one view.
npx -y evergist read "https://evergist.com/g/<id>#<key>" > secret.txt
Quote the link so the shell passes it through untouched. When that was the last view, the CLI says so on stderr, which keeps the redirected file clean. A recipient without Node can use the Python reader, about 30 lines written against the published scheme.
Can I pin the CLI instead of trusting npx?
Yes. The CLI is one file with no dependencies, served at evergist.com/cli/evergist.mjs. Download it, read it, record its checksum, and run that copy.
curl -fsSLO https://evergist.com/cli/evergist.mjs
shasum -a 256 evergist.mjs
node evergist.mjs create secret.txt --views 1 --expires 1h
Commit the file or the checksum to your tooling repo and the code that touches your secrets only changes when you change it. The lighter option is pinning the npm version with npx -y evergist@1.0.0. If the npm registry is blocked, npx -y https://evergist.com/cli/evergist.tgz runs the same package from our domain.
Does the CLI encrypt locally or send plaintext to the server?
It encrypts locally with AES-256-GCM. The API has no endpoint that takes plaintext and encrypts it for you. It stores whatever bytes a client uploads as ciphertext, so the encrypting is the client's job, and the CLI does it before upload. You can check this in the single file above or against the REST API docs. Why the note API has no plaintext endpoint explains the design.
Not every one-time secret tool works this way. Onetime Secret encrypts on its server with a key from the server's config, per its own encryption audit document, so its server receives your text before encrypting it. Before you pipe a secret into any CLI, find out which side encrypts. Private note sharing compared covers eight tools on that question.
What this doesn't do
- Anyone who gets the full link before your recipient can read the note. One view and a short expiry limit the window. They don't close it.
- Notes last 30 days at most. Keep long-lived secrets in a password manager or a secrets manager.
- It holds text up to 512 KiB. No file attachments.
Questions
How do I pipe a password into a one-time link?
Run printf '%s' "$PASSWORD" | npx -y evergist create --views 1 --expires 1h. The variable expands inside your shell, so the value doesn't show up in the process list, and --views 1 deletes the note after the first read.
Is there anything to install?
No. npx -y evergist fetches the package when you run it and needs Node.js 20 or newer. If you use it often, npm install -g evergist gives you a plain evergist command, and the single-file evergist.mjs runs with node alone.
Can I check a link without burning it?
Yes. npx -y evergist status "<link>" reports expiry, views left, and whether a password is set. It doesn't count as a view. The browser also waits for a click on "Open the note" before it spends a view on a view-limited note.
Can an AI agent run these commands?
Yes, the same commands work from an agent's shell, and npx -y evergist mcp runs a local MCP server with the same four operations. An agent that reads a note does see the value. The agent guide covers the setup.