How long should a secret link stay valid?
Expiry is a security control, not just a convenience setting
When you create a one-time secret link, one of the most important decisions is the expiry window: how long the link stays accessible before it self-destructs, unopened. Most people pick a number without thinking much about it. But the expiry window is actually a meaningful security parameter.
A link that never expires is almost as dangerous as sending the password directly — it sits there, accessible to anyone who intercepts or guesses it, until someone eventually opens it. A link that expires in five minutes may be too short for a recipient in a different timezone or one who is away from their desk.
The two competing risks
Setting an expiry window means balancing two risks:
Too long: The link remains accessible to an attacker who has intercepted the delivery message. The longer the window, the more time an attacker has to act on a compromised email or notification.
Too short: The link expires before the legitimate recipient opens it, requiring you to resend — possibly through a less secure channel, or with a fresh link that extends the total exposure window.
Practical guidelines by scenario
Scheduled handover (both parties are ready) Use 24 hours. You have confirmed the recipient is expecting the link and is available. A 24-hour window accommodates timezone differences and brief delays without leaving a credential link sitting around for days.
Sending to a client who may not check immediately Use 48–72 hours. Clients do not always act on emails same-day. A 48-hour window is a reasonable professional standard. Consider sending a heads-up message ("I'm about to send you a credentials link, please open it within 48 hours") to set expectations.
Emergency access for a colleague Use 1–2 hours. Emergency shares to a known colleague who is actively waiting should have the shortest possible window. If it expires, resending takes seconds.
Contractor onboarding Use 24 hours, but time the send so it arrives during the contractor's working hours. A link sent at 5 PM on a Friday with a 24-hour expiry will expire before Monday morning.
Unknown or variable recipient schedule Use 72 hours maximum, and follow up with a direct message asking the recipient to confirm they have opened it. If they have not after 48 hours, check in before the link expires.
The case for shorter by default
When in doubt, err toward shorter expiry windows. Here is why:
- Resending a link takes less than a minute
- The cost of a compromised credential is potentially very high
- Short expiry forces recipients to act promptly, which reduces the window for interception
- If a link expires, you know the recipient has not yet retrieved the credential — useful information
What happens to an expired link
On PassTransfer, an unopened link that reaches its expiry is simply deleted. It cannot be opened after expiry. This means an attacker who intercepts the delivery message but waits even a few hours past the expiry window gets nothing.
This is meaningfully different from a password sent via email, which persists indefinitely in inboxes and archives regardless of whether the recipient ever reads it.
Expiry is one piece of a larger workflow — our complete guide to secure password sharing covers the rest.
