AshNote CLI

Share secrets that self-destruct, straight from your terminal: a single native binary, no runtime needed. Fully zero-knowledge: encryption and decryption happen on your machine, the key travels only inside the link you share.

Install

brew tap arrowhacks-org/ashnote
brew install ashnote

If Homebrew reports an untrusted tap, allow it once with brew trust arrowhacks-org/ashnote. Works on macOS (Apple Silicon & Intel) and Linux. Homebrew on Linux uses the same tap. Prefer raw binaries? Grab them from the releases page and drop them into your PATH. The CLI is open source (Apache-2.0).

Usage

01

Hidden prompt: the safe default

ashnote send -i asks for the secret with hidden input, like sudo. Nothing lands in your shell history or the process list.

02

Pipes & files

cat .env | ashnote send --ttl 1h --reads 3 or ashnote send -f kubeconfig.yaml (files up to 256 KB). The link lands on stdout. Pipe it into pbcopy.

03

Receive

ashnote get "<link>" claims and decrypts locally. Text goes to stdout, files are written to disk. After the final read, the drop is gone for everyone.

$ ashnote send -i --ttl 1h
secret (hidden):
https://ashnote.io/d/…/…#key ← the key never left your machine

Options

  • -i, --interactive: hidden prompt (recommended for typed secrets)
  • -f, --file PATH: send a file instead of text
  • -t, --ttl 5m|1h|24h|3d|7d: expiry (default 24h)
  • -r, --reads N: reads before the drop burns (default 1)
  • -p, --passphrase: extra passphrase, mixed into the key locally
  • --api URL / env ASHNOTE_URL: self-hosted or staging backends

Shell-history honesty

ashnote send "secret" as an argument lands in your shell history and is visible inps while running. The CLI warns you when you do it interactively. Use-i, stdin or -f instead. And note that a received link in your history is mostly harmless: after its final read it is cryptographically worthless. For multi-read drops, prefix the command with a space (setopt HIST_IGNORE_SPACE in zsh) to keep it out of history entirely.