FAQ: Secure password sharing
Frequently asked questions about secure password sharing
Is it safe to share passwords at all?
Sharing passwords is sometimes unavoidable in professional contexts — handing over a client account, onboarding a team member, giving a contractor temporary access. The question is not whether to share, but how to do it safely. A one-time encrypted link is significantly safer than email, chat, or any other persistent channel.
What is a one-time link?
A one-time link is a URL that contains or delivers a secret exactly once. After the recipient opens the link, the secret is deleted from the server. If someone else tries to open the link later, they find nothing. This prevents the credential from persisting in any system after delivery.
What if the recipient opens the link before I send them the URL?
That would require the recipient to know the URL before you send it, which is essentially impossible — the URL contains a random key generated at creation time. If someone intercepts your delivery channel (e.g., your email), they could open it first. This is why short expiry windows matter, and why confirming receipt with the intended recipient adds a layer of assurance.
What if the link expires before the recipient opens it?
The link is deleted and the recipient cannot retrieve the secret. You simply create a new link and resend. The expiry is a feature — it limits the window of exposure if the delivery channel is compromised.
Is this GDPR compliant?
Using a one-time encrypted link tool substantially reduces the compliance risk associated with credential sharing. Passwords are not stored in plain text, are deleted after retrieval, and do not persist in email archives. For full compliance, choose a tool hosted in the EU and with a clear data processing policy. PassTransfer is hosted in the EU. Our overview of GDPR and password sharing covers this in more detail.
Do I need to create an account to receive a shared secret?
No. Recipients open the link in any browser without creating an account or installing anything. This is an important usability feature — requiring recipients to register would create friction that leads to insecure workarounds.
Can the service provider read my passwords?
This depends on the tool's architecture. PassTransfer encrypts secrets in the browser with AES-GCM (end-to-end), so the server only stores ciphertext it cannot read. The secrets are not accessible in plain text and are deleted immediately after retrieval. No logs contain the secret content.
Should I still change a password after sharing it via a one-time link?
For critical credentials, rotation after sharing is best practice regardless of the sharing method. For lower-stakes credentials shared with a trusted party who needs ongoing access, the risk is lower than with email-based sharing — but rotation is still a good habit for critical systems.
What is the difference between PassTransfer and a password manager?
A password manager (like 1Password or Bitwarden) stores credentials persistently for ongoing access. PassTransfer is a one-time sharing tool — it delivers a credential once and then destroys it. The two tools serve different purposes and work well together: use a password manager for storage and PassTransfer for secure outbound sharing.
Can I use this for more than passwords?
Yes. Any text secret can be shared via PassTransfer: API keys, private notes, license codes, SSH keys, recovery codes. If it is sensitive and needs to reach someone securely, a one-time link is a good delivery mechanism.
What happens if I share a link and the recipient says they never received it?
Check whether the link has been opened (PassTransfer shows whether a link has been retrieved). If it has been opened but not by your intended recipient, treat the credential as potentially compromised and rotate it immediately. If it has not been opened, the link is still valid (unless it has expired), and you can resend the link or create a new one.
Questions about the PassTransfer tool itself are answered in the product FAQ.
