Encrypted link vs email: which is more secure?
The question on paper
On the surface, email and an encrypted link are just two delivery mechanisms. Both can get information from one person to another. But their security properties are radically different, and those differences matter enormously when the information being delivered is a credential.
Email: what you're actually sending
When you send a password via email, you're creating a document that will be stored — potentially for years — in multiple places: your sent folder, the recipient's inbox, any mail servers that handled the message in transit, backup systems, and potentially email archives. That document contains the password in plaintext.
The transmission of the email may be encrypted in transit via TLS, but this is transport encryption — it protects the message as it moves between servers, not at the endpoints where it rests. The password sits unencrypted in both inboxes.
Email also has no concept of a message being "used up." The same email can be read hundreds of times by anyone who has access to the inbox. There is no indication to the sender that the message was opened, by whom, or when.
Encrypted link: what you're actually sending
When you use a service like PassTransfer, what travels via email (or chat, or any other channel) is a URL — not the secret itself. The URL contains a random key that can be used to decrypt and retrieve the secret from the server, but only once.
The security properties of this approach are fundamentally different:
- The email contains no secret — even if the email is compromised, an attacker only has a URL that may or may not still work
- The secret is encrypted at rest — the server stores an encrypted value; the decryption key is only in the URL
- Single retrieval — once the link is opened, the secret is deleted; a second attempt to open the link returns nothing
- Automatic expiry — if the link is never opened, the secret is deleted after a defined period
- No copies in inboxes — the email containing the link is harmless after the link has been used or expired
Head-to-head comparison
| Property | Email (plaintext password) | Encrypted one-time link |
|---|---|---|
| Secret visible in transit | Potentially yes | No |
| Secret stored in sender's inbox | Yes, permanently | No |
| Secret stored in recipient's inbox | Yes, permanently | No |
| Can be opened multiple times | Yes | No |
| Expires automatically | No | Yes |
| Sender notified if intercepted | No | Indirectly (link already opened) |
| GDPR compliant | Questionable | Better aligned |
The residual risk of links
Encrypted links are not a perfect solution. If an attacker intercepts the URL before the intended recipient opens it, they can use it. This is why:
- Links should have short expiry times
- You should tell recipients to open links promptly
- If a recipient reports that a link was already opened when they tried, you treat it as a potential breach
In practice, the window between sending a link and the recipient opening it is typically minutes to hours — a much smaller attack surface than a password sitting in an inbox indefinitely.
The verdict
For credential delivery, an encrypted one-time link is meaningfully more secure than a plaintext email on every dimension that matters: it protects at rest, it protects after delivery, and it protects against an inbox being compromised in the future.
PassTransfer is designed specifically for this use case. It takes less time than composing an email, and the security improvement is significant.
