What is a one-time link for passwords and how does it work?
The basic concept
A one-time link is exactly what it sounds like: a URL that works once. When the recipient opens the link, they see the secret. The moment they do, the secret is deleted from the server. If anyone else clicks the same link — or if the recipient tries to open it again — they get nothing.
This simple mechanism solves a problem that email, messaging apps, and even many password managers struggle with: how do you share a secret with someone without leaving a permanent copy of that secret lying around?
How it works step by step
- You enter the password (or any secret text) into a secure form
- The service encrypts it and stores the encrypted value with a unique random key
- You receive a URL containing that unique key — the service itself cannot reconstruct the plaintext without that key
- You send the URL to the intended recipient via email, chat, or any channel
- The recipient opens the URL — the service decrypts the secret and displays it
- The secret is immediately deleted from the server — the link is now dead
Most services, including PassTransfer, also allow you to set an expiry time. If the recipient hasn't opened the link within 24 hours (or whatever window you choose), it expires and the secret is deleted anyway.
Why encryption matters
Storing the encrypted value rather than the plaintext means that even if the database were compromised, an attacker would not obtain your passwords. The encryption key is embedded in the URL, which is never stored on the server. Without the URL, the stored data is useless.
How is this different from a password manager?
A password manager stores credentials for ongoing, repeated use. A one-time link is for a single handover — transferring a credential to someone else. The use cases are complementary:
- Use a password manager for your own credentials that you access regularly
- Use a one-time link when you need to hand a credential to someone else
After the handover, the recipient should ideally change the password and store it in their own password manager. The one-time link handles the transfer safely; the password manager handles ongoing storage.
Who uses one-time links?
- IT teams handing over server credentials to clients
- Developers sharing API keys with colleagues
- HR teams sending temporary login details to new employees
- Agencies providing CMS access to clients
- Anyone who needs to share a Wi-Fi password, database credential, or recovery code without it ending up in an email thread
The key security properties
A well-implemented one-time link service gives you:
- Confidentiality — the secret is encrypted in transit and at rest
- Forward secrecy — once viewed, nothing can be retrieved again
- Expiry — secrets that are never retrieved are automatically deleted
- No persistent copies — the server holds no plaintext, and after retrieval holds nothing at all
PassTransfer is built around exactly these principles. Creating a secure one-time link takes under a minute, requires no account, and leaves no trace once the recipient has retrieved what they need.
