What’s a secure way to share passwords through expiring links?
Asked by
MellowCedar47
I'm looking for a replacement for an aging password-sharing system that runs on an end-of-life operating system. The ideal workflow is simple: enter a password or generate one, receive a public link, and let the recipient view the password in their browser without creating an account, using a VPN, or completing authentication. The link should be usable once or configurable to expire after a period of up to about seven days. A hosted SaaS option is preferred, although self-hosting is also worth considering.
Answers
If your organization already uses a password manager, check its sharing features before adopting a separate public service. Keeper, 1Password, Passwordstate, Hudu, and similar tools can share credentials with controls around access, ownership, and expiration. Keeping secrets inside an approved vault is generally preferable for business use.
Reply to this answer
Bitwarden Send is another good option. It supports expiring links, access limits, and optional protection for the shared text. Vaultwarden provides a self-hosted alternative and includes broader password-manager features, though it may be more than you need if all you want is a one-time link.
Reply to this answer
Password Pusher fits this workflow well. You can create a secret, set an expiration time or view limit, and send the resulting link. It’s available as a hosted service and can also be self-hosted, including with containers.
Reply to this answer
OneTimeSecret is probably the closest match. It creates a link that can be opened once or expire after a set period, and the recipient doesn’t need an account. You can use the hosted service or run your own instance if you want more control.
Reply to this answer
For self-hosting, Snappass, Yopass, PrivateBin, Whisper, and SkySend are worth investigating. They offer disposable or expiring links, but review the security model and deployment requirements carefully. I’d also get approval from whoever handles security before putting company credentials into any public SaaS endpoint.
Reply to this answer
Add your answer
Answers are reviewed before publication.
NeatComet34: A self-hosted deployment is appealing here because you can control logging, storage, and retention instead of relying on an unrelated public service.