Security basics
Most people share passwords the same way they share everything else — over email, Slack, or a text message. It is convenient. It is also one of the most common ways credentials get exposed. This guide explains why common methods fail, what “secure” actually means when sharing a password, and how to do it in a way that leaves no trace.
Email is the most widely used channel for sharing credentials — and one of the most dangerous. Every message you send is stored on at least three servers: yours, your email provider's, and the recipient's. Many organisations also archive email indefinitely for compliance reasons. A password you emailed two years ago is almost certainly still sitting somewhere in a search index.
Beyond storage, email accounts are a primary target for phishing and credential stuffing attacks. If the recipient's inbox is ever compromised, every password you have sent them becomes accessible — not just recent ones, but every message in their archive.
Slack, Microsoft Teams, and similar platforms offer a false sense of security. Messages feel transient, but they are stored persistently and searchable by default. Many workspace plans retain full message history indefinitely. Administrators, compliance tools, and third-party integrations can all access message content. A password shared in a direct message is not private in any meaningful technical sense.
Text messages are stored on carrier infrastructure and often backed up to cloud services (iCloud, Google Drive) without users realising. WhatsApp messages, while encrypted in transit, are stored on the recipient's device and frequently backed up to cloud storage in plaintext. If either device is lost, stolen, or forensically examined, those messages are recoverable.
Many password managers support credential sharing between users. This is genuinely secure for ongoing relationships — colleagues on the same team, for example. But it requires both parties to use the same tool, creates a persistent shared record, and is overkill when you simply need to hand off a credential once to someone outside your organisation.
A genuinely secure handoff of a credential needs to satisfy three requirements:
Email, chat, and SMS fail on all three. A one-time encrypted link satisfies all three by design.
A one-time secret link is a URL that contains an encrypted secret. When the recipient opens it, two things happen simultaneously: the secret is decrypted in their browser and displayed, and the underlying data is permanently deleted from the server. Open the same link a second time and there is nothing left to retrieve.
The encryption happens in your browser before anything is sent to a server. The decryption key never leaves your browser — it lives in the URL fragment (the part after the #), which browsers never include in HTTP requests. This means the service storing the ciphertext cannot decrypt it. Even if the server were breached, an attacker would find only encrypted blobs with no keys.
This architecture is called zero-knowledge: the service operator has zero ability to read what you shared.
No account required. No sign-up. The entire process takes under a minute.
Once the secret is encrypted, the link is safe to send over any channel. The link contains only ciphertext and a key fragment that is never sent to the server. An attacker who intercepts the link cannot extract the password without opening it first — which burns the link and alerts the intended recipient that something went wrong.
That said, use a reasonably trusted channel for the link. If someone opens it before the recipient does, the recipient will know immediately because the link will be dead.
CYPH3RDROP links expire after 7 days if unopened. After that, the encrypted data is permanently deleted from the server. If your recipient misses the window, you will need to create a new link.
Avoid sending both in the same message. If you want to give the recipient context about what the link contains, send the hint separately — a different message, or a different channel. The goal is to avoid having both pieces of information in the same place.
Generate a separate link for each person. Each link is independent — burning one does not affect the others. This also lets you track whether each recipient has opened their link.
Yes. One-time links work for any text-based secret: API keys, SSH keys, private notes, .env file contents, database credentials, or any sensitive information you need to hand off once without leaving a trace.
Passwords shared over email or chat are never truly gone. They sit in archives, search indexes, and backups — sometimes for years. A one-time encrypted link eliminates that exposure entirely: the credential is encrypted before it leaves your device, stored only as ciphertext, and destroyed the moment it is read. It is the closest thing to handing someone a note and watching them read it in front of you.
Try it now
No account required. Paste a password, get a one-time link, share it. Done.
Create a secret link →