A private password workspace for your team

Your own environment is open to everyone by default

With PassTransfer Pro you share passwords from your own address, for example yourcompany.passtransfer.com, with your own logo and colours. That address is an ordinary web page, so anyone who knows it can send a password from it. In practice that is rarely a problem: it is an empty page with a form, and whoever uses it shares their own password with their own recipient.

For some organisations it is still the wrong default. What an outsider can do is send a password link that looks like it came from you. Your logo, your colours, your domain in the address bar. For agencies, IT partners and hosting companies that have spent years teaching clients to check the sender's domain, that is the wrong direction.

So you can close your environment.

What a closed workspace does

Close your environment from your settings and exactly one thing changes: only you and colleagues with a mailbox on a verified domain can still send a password from that address. Everyone else who opens the page sees a sign-in screen.

Retrieving a password stays open to everyone. It has to: the recipient of a link is an outsider by definition, usually a client without an account. A link you send today keeps working the way it always did.

How it works, in three steps

1. Verify your domain

You enter an email address on your own domain, for example you@yourcompany.com. We mail a confirmation link there. Whoever opens it proves the domain is yours. We derive the domain from that address and do not keep the address itself afterwards.

No DNS record has to change and no file has to be placed on your server. Public providers such as gmail.com or outlook.com cannot be verified, because "a mailbox on gmail.com" says nothing about which company someone works for.

2. Colleagues sign in with a login link

A colleague opens your address, fills in their work email and receives a login link. That link opens a confirmation page with a single button, and only the button signs them in. That is deliberate: mail scanners and link checkers in corporate mail environments open links automatically, and without that step the link would be spent before your colleague ever saw it. Why that happens is explained in why mail scanners can break one-time links.

No accounts are added, no passwords to manage, no per-user licences. The price of Pro does not change.

3. Outsiders stay out

An address outside your verified domains is sent no link. The screen answers it exactly as it answers an address that does check out, so nobody can read off which domains you configured.

Revoke a domain and everyone on it loses access straight away, including anyone signed in at that moment.

What it is not

This is a gate on the front door of your environment, and nothing more than that.

• It is not a control on what your colleagues share. Whoever gets in can send anything that fits in the form.
• It is not an audit log. We keep no record of who sent what from your environment. That is a deliberate choice: of a shared password we store only the encrypted value until it is retrieved or expires, and a send log would put a list of names and timestamps next to it. If you do need per-action evidence, read do you need an audit trail for password sharing?
• It stops nobody who simply wants to share a password. passtransfer.com is free and open to everyone. A colleague you remove shares the same password thirty seconds later from the free address, just without your branding. That is precisely what the gate protects.

Who this is useful for

A closed workspace matters most when your branding itself carries weight in the handover:

• Agencies and IT partners who taught clients to accept credentials only from their own address. See password sharing for agencies and for IT companies.
• Hosting companies handing over credentials daily, whose domain is familiar to thousands of customers.
• Organisations with an information security policy that states who communicates on behalf of the company. Domain verification and the login link are the demonstrable part of that agreement. How this fits wider requirements is covered in NIS2 and password sharing and GDPR and password sharing.