# SecretWolf

> SecretWolf is a UK-hosted SaaS for sending and requesting one-time secrets —
> passwords, API keys and files — as branded, encrypted links that are destroyed
> on first view, with a metadata-only audit trail. Built for agencies, MSPs and
> accountants who hand credentials to clients.

SecretWolf is operated by P2xel Ltd (UK). Secrets are encrypted with AES-256-GCM
and hard-deleted on view or expiry. Encryption is server-side, not browser-side
zero-knowledge: SecretWolf holds the encryption material while a secret is live.
In exchange it provides custom branding and domains, inbound secret requests,
recipient email verification, malware-scanned attachments, an audit trail and an
API — capabilities zero-knowledge tools structurally cannot offer.

## What it is not

- Not a password manager. It handles one-off handovers, not long-term storage,
  and sits alongside tools like 1Password or Bitwarden rather than replacing them.
- Not zero-knowledge. If browser-side encryption with no server-held key is a hard
  requirement, PrivateBin (self-hosted) or a client-side tool is the better fit.
- Not open source.

## Pricing

- Free — £0. 1 user, 3 active secrets, 7-day expiry, templates,
  QR codes, password generator. No card required.
- Team — £12/month (£120/year). Up to 5 users. Branded subdomain
  and logo, audit log, one-off secret requests, multi-view limits, view
  notifications, 30-day expiry.
- Business — £29/month (£290/year). Up to 15 users. Everything in
  Team plus custom domain, email sent from your own domain, single sign-on
  (OpenID Connect — Microsoft Entra ID or Google Workspace; no SAML, no SCIM),
  standing send portals, recipient OTP verification, encrypted attachments,
  API keys and webhooks, a Halo PSA integration, CSV export and retention
  policies.

Priced per workspace, not per seat. Excludes UK VAT. Downgrades are
non-destructive — existing links keep working.

## Core pages

- [Home](https://secretwolf.io/): what SecretWolf does and who it's for
- [Pricing](https://secretwolf.io/pricing): plans, limits, billing FAQ
- [Security](https://secretwolf.io/security): encryption, deletion, audit, tenant isolation,
  hosting, and how this differs from zero-knowledge tools
- [FAQ](https://secretwolf.io/faq): short answers to common questions
- [Single sign-on](https://secretwolf.io/sso): connecting Microsoft Entra ID or Google
  Workspace, what can be enforced, and what is not synced
- [Compliance](https://secretwolf.io/compliance): GDPR and assessment material
- [API docs](https://secretwolf.io/docs): creating secrets and requests programmatically
- [About](https://secretwolf.io/about): the company behind SecretWolf

## Who it's for

- [Who it's for](https://secretwolf.io/for): every segment page in one place
- [Agencies](https://secretwolf.io/for/agencies): client logins and API keys under your own brand
- [MSPs](https://secretwolf.io/for/msps): credential delivery with recipient verification and audit
- [Accountants](https://secretwolf.io/for/accountants): gateway and payroll logins, GDPR-minded
- [AI agents](https://secretwolf.io/for/ai-agents): pay-per-secret over the x402 protocol, no
  signup or API key

## Common tasks

- [All use cases](https://secretwolf.io/use-cases)
- [Client onboarding](https://secretwolf.io/use-cases/client-onboarding)
- [Client offboarding](https://secretwolf.io/use-cases/client-offboarding)
- [Helpdesk password resets](https://secretwolf.io/use-cases/helpdesk-password-resets)
- [Sending API keys](https://secretwolf.io/use-cases/sending-api-keys)
- [Password generator](https://secretwolf.io/tools/secure-password-generator)

## Machine payments (x402)

An AI agent can create a one-time secret link and pay for it in the same request,
with no account: `POST https://app.secretwolf.io/api/x402/secrets` costs $0.10 in
USDC on Base via the x402 protocol (facilitator: PayAI).
Send `{"text":"…"}` or a template (`templateKey`+`fields`); it returns
`{"url","id"}`. A malformed request is rejected before payment is taken.

There are two ways to hand the result on:

- Agent to human: give them the `url`. They open a branded page, see the secret
  once, and it is destroyed.
- Agent to agent: `POST https://app.secretwolf.io/api/x402/secrets/{id}/reveal` returns the value as
  JSON exactly once, then hard-deletes it. Free — creation was already paid, and
  the 256-bit id in the link is itself the capability, so no key is needed. The
  reveal is audited like any other.

Machine-readable description of both endpoints, including request and response
schemas: [OpenAPI 3.1](https://secretwolf.io/openapi/x402.json). Served from this host because
the app host is noindex and disallows crawlers.

## Key facts

- Encryption: AES-256-GCM (authenticated), applied server-side. Team passwords
  stored with PBKDF2.
- Sign-in: email and password with optional authenticator-app 2FA, or per-workspace
  single sign-on on Business — OpenID Connect to Microsoft Entra ID or Google
  Workspace. No SAML and no SCIM: accounts are not synced from a directory. Owners
  always keep a password route, so a broken identity provider cannot lock a
  workspace out.
- Deletion: hard delete of ciphertext on first view or at expiry, not soft-hide.
- Audit: metadata only — sender, recipient label, timestamps, viewing IP and user
  agent, verification status. Never secret content or decryption material.
- Recipient verification: optional 6-digit emailed code, 10-minute expiry,
  rate-limited.
- Attachments: 10 MB cap, type-restricted, malware-scanned, encrypted at rest.
- Hosting: UK infrastructure, HTTPS end to end, strict CSP, HSTS, per-endpoint
  rate limiting. Custom domains get automatic TLS.
- Recipients need no account, signup or install.
- Operator: P2xel Ltd, United Kingdom. Contact: https://secretwolf.io/contact