Frequently asked questions

You paste or generate a password, choose an expiry time (1 day, 1 week or 1 month) and get a unique link. Share it via email, WhatsApp or Slack. The recipient opens the link, sees the password once, and after that it is deleted from the server. For more background, read what is a one-time link for passwords?

No. Your password is encrypted in your browser before it is sent to us, and the key to decrypt it lives in the part of the link after the hash (#). That part never leaves the browser, so we only store an encrypted value we cannot decipher ourselves. We explain the difference with server-side encryption in client-side vs server-side encryption.

No. The recipient clicks the link and sees the password, without registration, app or extension. You don't need an account as a sender either: sharing passwords is free and anonymous.

As soon as the recipient retrieves the password, the stored value is deleted immediately. The link becomes unusable: anyone opening it again only sees a message that the password has already been retrieved.

After the chosen expiry time the link is invalidated automatically and the encrypted value is deleted. You simply create a new link. An expired link is by design: better than a password sitting there indefinitely. For tips on picking an expiry window, see what expiry time to choose for a secret link?

Yes. Anything that fits in a text field can be transferred once: API keys, PIN codes, recovery codes, activation codes or a short sensitive note.

As little as possible. Of a shared password we only keep the encrypted value until it is retrieved or expired. Recipients don't have to leave any details. Our servers are located in the Netherlands. See the privacy statement for the full overview.

With PassTransfer Pro you share passwords from your own environment: your own subdomain such as yourcompany.passtransfer.com, with your own logo, colours and background. Clients receive passwords in a familiar brand environment.